PT-2004-1872 · Samba · Samba

Published 2004-09-13 · Updated 2017-10-11 · CVE-2004-0807

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 3.0.6 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and memory exhaustion. This is triggered by sending certain malformed requests that cause new processes to be spawned, or by sending specially crafted packets to the smbd daemon during the ASN.1 parsing routine, causing many processes to spawn and resulting in a loss of availability for the platform.

Recommendations For Samba versions 3.0.6 and earlier, consider restricting access to the smbd daemon to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider implementing configuration changes to limit the number of processes that can be spawned by the smbd daemon.

Fix

Related Identifiers

CVE-2004-0807

RHSA-2004:467

Affected Products

Samba

References · 16

• http://gentoo.org/security/en/glsa/glsa-200409-16.xml · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20041201-01-P · Vendor Advisory
• http://idefense.com/application/poi/display?id=139&type=vulnerabilities · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:092 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0807 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-467.html · Vendor Advisory
• http://trustix.net/errata/2004/0046 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0807 · Security Note
• https://osv.dev/vulnerability/CVE-2004-0807 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0807 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109509335230495&w=2 · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=109509335230495&w=2 · Note
• http://marc.info/?l=bugtraq&m=109526231623307&w=2 · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=109526231623307&w=2 · Note