PT-2004-1878 · Samba+1 · Samba+1

Karol Wiesek · Published 2004-10-16 · Updated 2021-03-25 · CVE-2004-0815

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Samba versions 2.2.0 through 2.2.11 Samba versions 3.0.0 through 3.0.2a

Description The issue allows remote attackers to bypass specified share restrictions and access files and directories outside of the share path. This is due to the unix clean name function trimming certain directory names down to absolute paths when "/.////" style sequences are used in pathnames. The unix convert() function converts names from the DOS namespace to Unix namespace and calls unix clean name(), which removes double slashes, leading './' characters, and '..' directory-traversal characters. However, this process can be exploited to specify the real path of any file on the computer.

Recommendations For Samba versions 2.2.0 through 2.2.11, update to a version outside of this range to mitigate the risk. For Samba versions 3.0.0 through 3.0.2a, update to version 3.0.2a or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories until a patch is applied.

Exploit

Fix

Related Identifiers

ALT-PU-2021-1547

CVE-2004-0815

DSA-600-1

Affected Products

Alt Linux

Samba

References · 52

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/samba/trans2open.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/samba/trans2open.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/samba/trans2open.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/trans2open.rb · Exploit
• 🔥 http://idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=true · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0086 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07588 · Security Note
• http://redhat.com/support/errata/RHSA-2004-498.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1154 · Security Note
• http://trustix.org/errata/2004/0051 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04793 · Security Note
• https://bdu.fstec.ru/vul/2015-07575 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0815 · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104 · Vendor Advisory