CVE-2007-5667
Estado: ModificadaAlta (7.2)—
NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations.
CVSS
- Versión: 2.0
- Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
- Puntuación base: 7.2
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.37%
- Percentil entre todas las CVEs puntuadas: 28
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-20
Referencias
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=626
- http://osvdb.org/40867
- http://secunia.com/advisories/27678
- http://www.securityfocus.com/bid/26420
- http://www.securitytracker.com/id?1018943
- http://www.vupen.com/english/advisories/2007/3846
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38434
- https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=626
- http://osvdb.org/40867
- http://secunia.com/advisories/27678
- http://www.securityfocus.com/bid/26420
- http://www.securitytracker.com/id?1018943
- http://www.vupen.com/english/advisories/2007/3846
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38434
- https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2007-5667",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.2,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2007-11-14T01:46:00.000",
"references": [
{
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=626",
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/40867",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/27678",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/26420",
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1018943",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2007/3846",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38434",
"source": "cve@mitre.org"
},
{
"url": "https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=626",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/40867",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/27678",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/26420",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1018943",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2007/3846",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38434",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \\.\\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations."
},
{
"lang": "es",
"value": "NWFILTER.SYS en Novell Client 4.91 SP 1 hasta el SP 4 para Windows 2000, XP, y Server 2003 toma el dispositivo disponible \\.\\nwfilter para entradas METHOD_NEITHER IOCTLs en modo usuario de su elección, lo cual permite a usuarios locales ganar privilegios pasando la dirección del núcleo como un argumento y sobrescribiendo localizaciones de la memoria del núcleo."
}
],
"lastModified": "2026-06-16T22:46:36.337",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:adv_srv:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4A894A39-8BB4-4923-B4CD-1CB93703B428"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:datacenter_srv:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C3822450-7A42-45DD-A172-E964409C5BB7"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:pro:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "26CF0F23-E9B6-415F-868A-C883EF11F389"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:srv:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "09C3156A-9DCF-4217-A5AC-9D3A5654CAC1"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:*:*:srv:ja:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "64546AE1-1691-4BAF-B2C9-6698F3FFDF87"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "685F1981-EA61-4A00-89F8-A748A88962F8"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "580632FB-7EB8-4DC6-A372-742D4523BF79"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:std:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9562EC45-0F28-4E4D-AA16-7E34241F26B5"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:wed:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1DA5F012-9457-4562-B50C-2C674008B494"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CD264C73-360E-414D-BE22-192F92E5A0A3"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:x64-std:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4EF7C885-1142-477C-9AA2-5068EB9EFE82"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:xp-64bit:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5B5D0781-714B-4BE8-B74A-3A2CBC58F604"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EAA86830-BEA8-4943-83EA-C267FA534223"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "31A64C69-D182-4BEC-BA8A-7B405F5B2FC0"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:64bit:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "40DCD873-93E3-403A-8446-65F7E1B4FAD8"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:embedded:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B95B2BE4-B4E0-4B77-9999-53B9224F5CB1"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:ibm_oem:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "81A690FA-1808-4E4F-8CBC-75FB5358D439"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "403945FA-8676-4D98-B903-48452B46F48F"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:pro:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19DA594E-B495-4C5D-BC94-79582D3983C9"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:tablet_pc:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E4707F3F-F79E-4085-A81B-569204B7B1DB"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ACF75FC8-095A-4EEA-9A41-C27CFF3953FB"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B47EBFCC-1828-45AB-BC6D-FB980929A81A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:novell:client:4.91:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E98A16C1-2026-4C53-B22E-51F07028DCB8"
},
{
"criteria": "cpe:2.3:a:novell:client:4.91:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78A17422-1FFE-4942-A6F1-01F99E4D42F9"
},
{
"criteria": "cpe:2.3:a:novell:client:4.91:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0CBDEB2-98CF-4C6A-A45A-F5B61803E449"
},
{
"criteria": "cpe:2.3:a:novell:client:4.91:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EDDFB0E9-EF4C-4E9E-9369-453AF2A8481F"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}