PT-2004-1288 · Samba · Samba

Publicado 2004-03-03 · Atualizado 2018-10-30 · CVE-2004-0082

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 3.0.0 through 3.0.1

Description The issue is related to the mksmbpasswd shell script (mksmbpasswd.sh) in Samba, which may overwrite the user password with an uninitialized buffer when creating an account but marking it as disabled. This could enable the account with a more easily guessable password. The flaw may allow a malicious user to gain access, resulting in a loss of confidentiality and integrity.

Recommendations For Samba versions 3.0.0 and 3.0.1, consider disabling the use of the mksmbpasswd.sh script until a patch is available to prevent potential unauthorized access. For Samba versions 3.0.0 and 3.0.1, restrict access to account creation functionality to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-0082

RHSA-2004:064

Produtos afetados

Samba

Referências · 14

• http://xforce.iss.net/xforce/xfdb/15132 · Nota
• http://osvdb.org/3919 · Nota
• https://security-tracker.debian.org/tracker/CVE-2004-0082 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0082 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15132 · Nota
• http://vuxml.org/freebsd/3388eff9-5d6e-11d8-80e3-0020ed76ef5a.html · Nota
• https://osv.dev/vulnerability/CVE-2004-0082 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0082 · Nota de Segurança
• http://us1.samba.org/samba/ftp/WHATSNEW-3.0.2a.txt · Nota
• http://ciac.org/ciac/bulletins/o-078.shtml · Nota
• http://securityfocus.com/bid/9637 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A827 · Nota
• http://redhat.com/support/errata/RHSA-2004-064.html · Aviso do Fabricante
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:827 · Nota