Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2004-0815

The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.

Published

2004-11-03T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	samba	samba	2.2.0	Yes
Application	samba	samba	2.2.0a	Yes
Application	samba	samba	2.2.1a	Yes
Application	samba	samba	2.2.2	Yes
Application	samba	samba	2.2.3	Yes
Application	samba	samba	2.2.3a	Yes
Application	samba	samba	2.2.4	Yes
Application	samba	samba	2.2.5	Yes
Application	samba	samba	2.2.6	Yes
Application	samba	samba	2.2.7	Yes
Application	samba	samba	2.2.7a	Yes
Application	samba	samba	2.2.8	Yes
Application	samba	samba	2.2.8a	Yes
Application	samba	samba	2.2.9	Yes
Application	samba	samba	2.2.11	Yes
Application	samba	samba	2.2a	Yes
Application	samba	samba	3.0.0	Yes
Application	samba	samba	3.0.1	Yes
Application	samba	samba	3.0.2	Yes
Application	samba	samba	3.0.2a	Yes

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 Patch, Vendor Advisory ([email protected])
http://marc.info/?l=bugtraq&m=109655827913457&w=2 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1 ([email protected])
http://us4.samba.org/samba/news/#security_2.2.12 ([email protected])
http://www.debian.org/security/2004/dsa-600 Patch, Vendor Advisory ([email protected])
http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=true Exploit, Vendor Advisory ([email protected])
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104 ([email protected])
http://www.novell.com/linux/security/advisories/2004_35_samba.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2004-498.html ([email protected])
http://www.securityfocus.com/archive/1/377618 ([email protected])
http://www.securityfocus.com/bid/11281 Patch, Vendor Advisory ([email protected])
http://www.trustix.org/errata/2004/0051/ ([email protected])
https://bugzilla.fedora.us/show_bug.cgi?id=2102 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/17556 ([email protected])
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=109655827913457&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1 (af854a3a-2127-422b-91ae-364da2661108)
http://us4.samba.org/samba/news/#security_2.2.12 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2004/dsa-600 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=true Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104 (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2004_35_samba.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2004-498.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/377618 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/11281 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.trustix.org/errata/2004/0051/ (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.fedora.us/show_bug.cgi?id=2102 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/17556 (af854a3a-2127-422b-91ae-364da2661108)