CVE-2004-0600 Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.
HighCVSS 10.0
EPSS 29.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.2 | No fix listed |
| samba | = 3.0.2a | No fix listed |
| samba | = 3.0.3 | No fix listed |
| samba | = 3.0.4 | No fix listed |
| trustix secure linux | = 1.5 | No fix listed |
| trustix secure linux | = 2.0 | No fix listed |
| trustix secure linux | = 2.1 | No fix listed |
| debian/samba(Debian:12) | < 3.0.5 | 3.0.5 |
| debian/samba(Debian:13) | < 3.0.5 | 3.0.5 |
| debian/samba(Debian:14) | < 3.0.5 | 3.0.5 |
References
- Debian Security Tracker CVE-2004-0600 vendor-advisory
- bugs.debian.org issue-tracking
- CLA-2004:851 vendor-advisory
- CLA-2004:854 vendor-advisory
- 20040722 Security Release - Samba 3.0.5 and 2.2.10 mailing-list
- 20040722 [OpenPKG-SA-2004.033] OpenPKG Security Advisory (samba) mailing-list
- 20040722 Samba 3.x swat preauthentication buffer overflow mailing-list
- 20040722 TSSA-2004-014 - samba mailing-list
- 20040722 SWAT PreAuthorization PoC mailing-list
- GLSA-200407-21 vendor-advisory
- MDKSA-2004:071 vendor-advisory
- SUSE-SA:2004:022 vendor-advisory
- RHSA-2004:259 patch vendor-advisory
- 2004-0039 vendor-advisory
- samba-swat-base64-bo(16785) vdb-entry
- oval:org.mitre.oval:def:11445 signature vdb-entry