CVE Vulnerabilities

CVE-2007-0454

Use of Externally-Controlled Format String

Published: Feb 06, 2007 | Modified: Nov 21, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.

Weakness

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected Software

Name Vendor Start Version End Version
Samba Samba 3.0.6 (including) 3.0.6 (including)
Samba Samba 3.0.7 (including) 3.0.7 (including)
Samba Samba 3.0.8 (including) 3.0.8 (including)
Samba Samba 3.0.9 (including) 3.0.9 (including)
Samba Samba 3.0.10 (including) 3.0.10 (including)
Samba Samba 3.0.11 (including) 3.0.11 (including)
Samba Samba 3.0.12 (including) 3.0.12 (including)
Samba Samba 3.0.13 (including) 3.0.13 (including)
Samba Samba 3.0.14 (including) 3.0.14 (including)
Samba Samba 3.0.14a (including) 3.0.14a (including)
Samba Samba 3.0.20 (including) 3.0.20 (including)
Samba Samba 3.0.20a (including) 3.0.20a (including)
Samba Samba 3.0.20b (including) 3.0.20b (including)
Samba Samba 3.0.21 (including) 3.0.21 (including)
Samba Samba 3.0.21a (including) 3.0.21a (including)
Samba Samba 3.0.21b (including) 3.0.21b (including)
Samba Samba 3.0.21c (including) 3.0.21c (including)
Samba Samba 3.0.22 (including) 3.0.22 (including)
Samba Samba 3.0.23d (including) 3.0.23d (including)
Samba Ubuntu dapper *
Samba Ubuntu devel *
Samba Ubuntu edgy *
Samba Ubuntu feisty *

Potential Mitigations

References