National Cyber-Alert System

Vulnerability Summary for CVE-2007-4138

Overview

The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (09/18/2007)

Not vulnerable. These issues did not affect the versions of Samba as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-352A

Name: TA07-352A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-352A.html

External Source: BID

Name: 25636

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/25636

External Source: VUPEN

Name: ADV-2007-3120

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2007/3120

External Source: SECUNIA

Name: 26764

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/26764

External Source: BUGTRAQ

Name: 20070911 [SECURITY] Winbind's rfc2307 & SFU nss_info plugin in Samba 3.0.25[a-c] assigns users a primary gid of 0 by default

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/479078/100/0/threaded

External Source: CONFIRM

Name: http://www.samba.org/samba/security/CVE-2007-4138.html

Hyperlink:http://www.samba.org/samba/security/CVE-2007-4138.html

External Source: FEDORA

Name: FEDORA-2007-2145

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00201.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1705

Hyperlink:https://issues.rpath.com/browse/RPL-1705

External Source: XF

Name: samba-smb-privilege-escalation(36560)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36560

External Source: SECTRACK

Name: 1018681

Hyperlink:http://www.securitytracker.com/id?1018681

External Source: REDHAT

Name: RHSA-2007:1017

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1017.html

External Source: REDHAT

Name: RHSA-2007:1016

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1016.html

External Source: SLACKWARE

Name: SSA:2007-255-02

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.419439

External Source: SREASON

Name: 3135

Hyperlink:http://securityreason.com/securityalert/3135

External Source: SECUNIA

Name: 26834

Hyperlink:http://secunia.com/advisories/26834

External Source: SECUNIA

Name: 26795

Hyperlink:http://secunia.com/advisories/26795

External Source: SECUNIA

Name: 26776

Hyperlink:http://secunia.com/advisories/26776

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307179

Hyperlink:http://docs.info.apple.com/article.html?artnum=307179