Executive Summary
| Summary | |
|---|---|
| Title | Updated samba packages fix security vulnerability |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2004:064 | First vendor Publication | 2004-02-18 |
| Vendor | RedHat | Last vendor Modification | 2004-02-18 |
| Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2004-064.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10675 | |||
| Oval ID: | oval:org.mitre.oval:def:10675 | ||
| Title: | The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password. | ||
| Description: | The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0082 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:827 | |||
| Oval ID: | oval:org.mitre.oval:def:827 | ||
| Title: | Samba mksmboasswd Disabled Account Creation Vulnerability | ||
| Description: | The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0082 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | Samba 3.0.0 and 3.0.1 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-04 | Name : FreeBSD Ports: samba File : nvt/freebsd_samba5.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 3919 | Samba mksmbpasswd.sh Uninitialized Passwords Samba contains a flaw that may allow a malicious user to gain access. The issue is triggered when mksmbpasswd.sh is used to create accounts, and does not initialize passwords. It is possible that the flaw may allow unauthorized access resulting in a loss of confidentiality and integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-11-18 | Name : The remote host might contain a flawed account management script. File : samba_mksmbpasswd.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_3388eff95d6e11d880e30020ed76ef5a.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-064.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-05-02 13:24:11 |
|
| 2014-02-17 11:48:24 |
|
