PT-2004-1772 · Samba+1 · Samba+1

Published 2004-07-23 · Updated 2022-08-29 · CVE-2004-0686

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Samba versions 2.2.x through 2.2.9 Samba versions 3.0.0 through 3.0.4

Description A buffer overflow issue exists when the mangling method = hash option is enabled in smb.conf. The impact and attack vectors of this issue are not specified. The remote Samba server may be vulnerable to this buffer overflow if the 'mangling method' is set to 'hash' in smb.conf.

Recommendations For Samba versions 2.2.x through 2.2.9, consider disabling the mangling method = hash option in smb.conf as a temporary workaround. For Samba versions 3.0.0 through 3.0.4, consider disabling the mangling method = hash option in smb.conf as a temporary workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ALT-PU-2021-1567

CVE-2004-0686

RHSA-2004:259

Affected Products

Alt Linux

Samba

References · 27

• http://gentoo.org/security/en/glsa/glsa-200407-21.xml · Vendor Advisory
• http://trustix.org/errata/2004/0039 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-1567 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109094272328981&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0829 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0686 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0686 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0686 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2004-0686 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2196 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0686 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2546 · Security Note
• http://novell.com/linux/security/advisories/2004_22_samba.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0686 · Vendor Advisory