PT-2000-1849 · Samba · Samba

Published 2000-12-19 · Updated 2017-10-10 · CVE-2000-0937

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba version 2.0.7

Description The issue concerns the Samba Web Administration Tool (SWAT) in Samba, where it fails to log login attempts with correct usernames but incorrect passwords. This oversight enables remote attackers to perform brute force password guessing attacks without being detected.

Recommendations For Samba version 2.0.7, consider implementing additional logging mechanisms to track all login attempts, including those with correct usernames and incorrect passwords, to detect and prevent brute force attacks. As a temporary workaround, restrict access to the SWAT interface to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2000-0937

Affected Products

Samba

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2000-10/0430.html · Exploit
• 🔥 https://exploit-db.com/exploits/20340 · Exploit
• 🔥 http://securityfocus.com/bid/1873 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0937 · Security Note
• http://xforce.iss.net/static/5442.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5442 · Note