PT-2004-1288 · Samba · Samba

Published 2004-03-03 · Updated 2018-10-30 · CVE-2004-0082

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 3.0.0 through 3.0.1

Description The issue is related to the mksmbpasswd shell script (mksmbpasswd.sh) in Samba, which may overwrite the user password with an uninitialized buffer when creating an account but marking it as disabled. This could enable the account with a more easily guessable password. The flaw may allow a malicious user to gain access, resulting in a loss of confidentiality and integrity.

Recommendations For Samba versions 3.0.0 and 3.0.1, consider disabling the use of the mksmbpasswd.sh script until a patch is available to prevent potential unauthorized access. For Samba versions 3.0.0 and 3.0.1, restrict access to account creation functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0082

RHSA-2004:064

Affected Products

Samba

References · 14

• https://security-tracker.debian.org/tracker/CVE-2004-0082 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0082 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0082 · Security Note
• http://securityfocus.com/bid/9637 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-064.html · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/15132 · Note
• http://osvdb.org/3919 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15132 · Note
• http://vuxml.org/freebsd/3388eff9-5d6e-11d8-80e3-0020ed76ef5a.html · Note
• http://us1.samba.org/samba/ftp/WHATSNEW-3.0.2a.txt · Note
• http://ciac.org/ciac/bulletins/o-078.shtml · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A827 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:827 · Note