CVEvulnerability
CVE-2004-0815
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2004-11-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.
Affected configurations
• samba samba 2.2.0
• samba samba 2.2.0a
• samba samba 2.2.1a
• samba samba 2.2.2
• samba samba 2.2.3
• samba samba 2.2.3a
• samba samba 2.2.4
• samba samba 2.2.5
• samba samba 2.2.6
• samba samba 2.2.7
• samba samba 2.2.7a
• samba samba 2.2.8
• samba samba 2.2.8a
• samba samba 2.2.9
• samba samba 2.2.11
• samba samba 2.2a
• samba samba 3.0.0
• samba samba 3.0.1
• samba samba 3.0.2
• samba samba 3.0.2a
Related
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 Patch, Vendor Advisory
- http://marc.info/?l=bugtraq&m=109655827913457&w=2 marc.info
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 sunsolve.sun.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1 sunsolve.sun.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1 sunsolve.sun.com
- http://us4.samba.org/samba/news/#security_2.2.12 us4.samba.org
- http://www.debian.org/security/2004/dsa-600 Patch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=true Exploit, Vendor Advisory
- http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104 www.mandrakesecure.net
- http://www.novell.com/linux/security/advisories/2004_35_samba.html www.novell.com
- http://www.redhat.com/support/errata/RHSA-2004-498.html www.redhat.com
- http://www.securityfocus.com/archive/1/377618 www.securityfocus.com
- http://www.securityfocus.com/bid/11281 Patch, Vendor Advisory
- http://www.trustix.org/errata/2004/0051/ www.trustix.org
- https://bugzilla.fedora.us/show_bug.cgi?id=2102 bugzilla.fedora.us
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17556 exchange.xforce.ibmcloud.com
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873 Patch, Vendor Advisory
- http://marc.info/?l=bugtraq&m=109655827913457&w=2 marc.info
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1 sunsolve.sun.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1 sunsolve.sun.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1 sunsolve.sun.com
- http://us4.samba.org/samba/news/#security_2.2.12 us4.samba.org
- http://www.debian.org/security/2004/dsa-600 Patch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=true Exploit, Vendor Advisory
- http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104 www.mandrakesecure.net
- http://www.novell.com/linux/security/advisories/2004_35_samba.html www.novell.com
- http://www.redhat.com/support/errata/RHSA-2004-498.html www.redhat.com
- http://www.securityfocus.com/archive/1/377618 www.securityfocus.com
- http://www.securityfocus.com/bid/11281 Patch, Vendor Advisory
- http://www.trustix.org/errata/2004/0051/ www.trustix.org
- https://bugzilla.fedora.us/show_bug.cgi?id=2102 bugzilla.fedora.us
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17556 exchange.xforce.ibmcloud.com