CVE-2007-4138: Medium severity Samba Samba vulnerability
The Winbind nssinfo extension (nsswitch/idmapad.c) in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the risk associated with CVE-2007-4138?
CVE-2007-4138 can allow local users to gain root privileges due to improper handling of group attributes.
Which versions of Samba are affected by CVE-2007-4138?
Samba versions 3.0.25, 3.0.25a, 3.0.25b, and 3.0.25c are affected by CVE-2007-4138.
How do I mitigate the effects of CVE-2007-4138?
To mitigate CVE-2007-4138, ensure that the 'winbind nss info' option is not set to rfc2307 or sfu.
Is CVE-2007-4138 a critical vulnerability?
CVE-2007-4138 is considered a serious vulnerability due to its potential to allow unauthorized access to system privileges.
What action should be taken if CVE-2007-4138 is detected in my system?
If CVE-2007-4138 is detected, it is recommended to upgrade to a patched version of Samba immediately.