« Volver al listado

CVE-2007-0454

Estado: ModificadaAlta (7.5)—

Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-0454",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-02-06T02:28:00.000",
  "references": [
    {
      "url": "http://osvdb.org/33101",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24021",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24046",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24060",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24067",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24101",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24145",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/24151",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://securitytracker.com/id?1017588",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.476916",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://us1.samba.org/samba/security/CVE-2007-0454.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1257",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200702-01.xml",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/649732",
      "tags": [
        "US Government Resource"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:034",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/459179/100/0/threaded",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/459365/100/0/threaded",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/22403",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.trustix.org/errata/2007/0007",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-419-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/0483",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32304",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-1005",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://osvdb.org/33101",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24021",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24046",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24060",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24067",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24101",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24145",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24151",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1017588",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.476916",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://us1.samba.org/samba/security/CVE-2007-0454.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1257",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200702-01.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/649732",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:034",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/459179/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/459365/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/22403",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.trustix.org/errata/2007/0007",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-419-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/0483",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32304",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-1005",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cadena de formato en el módulo VFS afsacl.so en Samba versión 3.0.6 hasta 3.0.23d permite a los atacantes dependiendo del contexto ejecutar código arbitrario por medio de especificadores de cadena de formato en un nombre de archivo sobre un sistema de archivos AFS, que no se maneja apropiadamente durante la asignación ACL de Windows."
    }
  ],
  "lastModified": "2026-06-16T22:35:36.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D40F682-9F2E-465F-98F7-23E1036C74A2"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9478CC84-802F-4960-ACAB-3700154E813F"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BEA3806-E33A-49A6-99A4-095B4E543C43"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA7D08FB-30B9-4E42-B831-21A0C095062C"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13E6C8A4-FA17-44EF-A447-C73108540B59"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57D5EA00-CC2E-4E56-8297-A3C1CEDBBE06"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50E05AD3-C7F0-421D-8C9B-604E553332E2"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A53517C-F12D-4D74-A722-5AE23598CEC4"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BF4A0A7-E176-4009-BAA2-E23B330D91A6"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.14a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42EB6115-CC45-4464-8400-D7E3A9402803"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F002F105-A911-4E56-8630-C287DC527E05"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.20a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1936E19-9887-4E53-AA0C-738ABD4B97EE"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.20b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2206C09-6A4B-4EC4-A206-E48EDF966913"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B918306-8743-404D-A035-CC3997ADCC3C"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.21a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43684906-D3AA-40FB-A75D-ED65C1DC9BB4"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.21b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62E39538-4811-49DB-97CF-1F018C58BAE4"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.21c:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C85D69FE-AF43-4B0E-A7A9-2D2C16426180"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86347948-C08F-4F02-89A0-4F4A55CD4BA7"
            },
            {
              "criteria": "cpe:2.3:a:samba:samba:3.0.23d:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54FE8D2E-AF0D-4C84-A5BC-2CE6759B534C"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CAE037F-111C-4A76-8FFE-716B74D65EF3"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:alpha:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6B060E4-B5A6-4469-828E-211C52542547"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:arm:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "974C3541-990C-4CD4-A05A-38FA74A84632"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:hppa:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CBF1E0F-C7F3-4F83-9E60-6E63FA7D2775"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58792F77-B06F-4780-BA25-FE1EE6C3FDD9"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9419322-572F-4BB6-8416-C5E96541CF33"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:m68k:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFC50555-C084-46A3-9C9F-949C5E3BB448"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:mips:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C25D6E1-D283-4CEA-B47B-60C47A5C0797"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD18A446-C634-417E-86AC-B19B6DDDC856"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:ppc:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4BB852E-61B2-4842-989F-C6C0C901A8D7"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:s-390:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24DD9D59-E2A2-4116-A887-39E8CC2004FC"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.0:*:sparc:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F28D7457-607E-4E0C-909A-413F91CFCD82"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2E0C1F8-31F5-4F61-9DF7-E49B43D3C873"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:alpha:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BF84240-1881-4EFB-BB2F-F9CE8AD09C7B"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:amd64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF8AE8C4-810F-41AB-A251-5A2D4DD6884D"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:arm:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EACF214-FA27-44FF-A431-927AB79377A1"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:hppa:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2B58895-0E2A-4466-9CB2-0083349A83B2"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03F8220A-9B1C-40AA-AEAB-F9A93225FBD5"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2311919C-7864-469D-B0F6-9B11D8D0A1C3"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:m68k:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19876495-4C1A-487C-955A-C5AA46362A1F"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:mips:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D75286DD-50BC-4B72-8AC8-E20730124DC2"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1998C972-497E-4916-B50E-FB32303EEA8E"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:ppc:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6CD3DD9-3A8A-4716-A2D1-136A790AFF94"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:s-390:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CE2020A-4FB2-4FCD-8561-7BD147CD95EB"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:sparc:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08E90AFA-C262-46D0-B60E-26B67C9602D5"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "597094EC-D23F-4EC4-A140-96F287679124"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux:2006:*:x86_64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07EC6C5A-33C9-456A-A8C9-0DF67C76041E"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BB0B27C-04EA-426F-9016-7406BACD91DF"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:x86_64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB2B1BA5-8370-4281-B5C9-3D4FE6C70FBC"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94F65351-C2DA-41C0-A3F9-1AE951E4386E"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B795F9F-AFB3-4A2A-ABC6-9246906800DE"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linuxsoft_2007:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7F55B87-1876-4855-9F62-9D6E2D295588"
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linuxsoft_2007:*:*:x86_64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A0D5740-DD4E-408C-B70F-FD1E7626E1DB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable. These issues affect the AFS ACL module which is not distributed with Samba in Red Hat Enterprise Linux 2.1, 3, 4, or 5.",
      "lastModified": "2007-05-14T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}