PT-2004-1872 · Samba · Samba

Publicado 2004-09-13 · Atualizado 2017-10-11 · CVE-2004-0807

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 3.0.6 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and memory exhaustion. This is triggered by sending certain malformed requests that cause new processes to be spawned, or by sending specially crafted packets to the smbd daemon during the ASN.1 parsing routine, causing many processes to spawn and resulting in a loss of availability for the platform.

Recommendations For Samba versions 3.0.6 and earlier, consider restricting access to the smbd daemon to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider implementing configuration changes to limit the number of processes that can be spawned by the smbd daemon.

Correção

Identificadores relacionados

CVE-2004-0807

RHSA-2004:467

Produtos afetados

Samba

Referências · 16

• http://gentoo.org/security/en/glsa/glsa-200409-16.xml · Aviso do Fabricante
• ftp://patches.sgi.com/support/free/security/advisories/20041201-01-P · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=109509335230495&w=2 · Nota
• http://idefense.com/application/poi/display?id=139&type=vulnerabilities · Aviso do Fabricante
• http://marc.theaimsgroup.com/?l=bugtraq&m=109509335230495&w=2 · Nota
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:092 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0807 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=109526231623307&w=2 · Nota
• http://redhat.com/support/errata/RHSA-2004-467.html · Aviso do Fabricante
• http://trustix.net/errata/2004/0046 · Aviso do Fabricante
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0807 · Nota de Segurança
• http://marc.theaimsgroup.com/?l=bugtraq&m=109526231623307&w=2 · Nota
• https://osv.dev/vulnerability/CVE-2004-0807 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2004-0807 · Aviso do Fabricante