CVE-2004-0930 The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple...
MediumCVSS 5.0
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.0 | No fix listed |
| samba | = 3.0.3 | No fix listed |
| samba | = 3.0.4 | No fix listed |
| samba | = 3.0.5 | No fix listed |
| samba | = 3.0.6 | No fix listed |
| samba | = 3.0.7 | No fix listed |
| sgi samba | = 3.0 | No fix listed |
| sgi samba | = 3.0.1 | No fix listed |
| sgi samba | = 3.0.2 | No fix listed |
| sgi samba | = 3.0.3 | No fix listed |
| sgi samba | = 3.0.4 | No fix listed |
| sgi samba | = 3.0.5 | No fix listed |
| sgi samba | = 3.0.6 | No fix listed |
| sgi samba | = 3.0.7 | No fix listed |
| conectiva linux | = 10.0 | No fix listed |
| gentoo linux | All versions | No fix listed |
| redhat enterprise linux | = 2.1 | No fix listed |
| redhat enterprise linux | = 3.0 | No fix listed |
| redhat enterprise linux desktop | = 3.0 | No fix listed |
| redhat fedora core | = core_2.0 | No fix listed |
| redhat fedora core | = core_3.0 | No fix listed |
| redhat linux advanced workstation | = 2.1 | No fix listed |
| debian/samba(Debian:12) | < 3.0.8-1 | 3.0.8-1 |
| debian/samba(Debian:13) | < 3.0.8-1 | 3.0.8-1 |
| debian/samba(Debian:14) | < 3.0.8-1 | 3.0.8-1 |
References
- CLA-2004:899 vendor-advisory
- APPLE-SA-2005-03-21 vendor-advisory
- 20041108 [SECURITY] CAN-2004-0930: Potential Remote Denial of Service Vulnerability mailing-list
- OpenPKG-SA-2004.054 vendor-advisory
- 101783 vendor-advisory
- GLSA-200411-21 vendor-advisory
- 20041108 Samba SMBD Remote Denial of Service Vulnerability exploit patch third-party-advisory vendor-advisory
- MDKSA-2004:131 vendor-advisory
- SUSE-SA:2004:040 vendor-advisory
- 11624 patch vdb-entry vendor-advisory
- samba-msfnmatch-dos(17987) vdb-entry
- oval:org.mitre.oval:def:10936 signature vdb-entry
- USN-22-1 vendor-advisory
- Debian Security Tracker CVE-2004-0930 vendor-advisory