The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.

According to a Samba Team security notice :

A security vulnerability has been located in Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for the connection.

The original notice for CAN-2004-0815 indicated that Samba 3.0.x <= 3.0.5 was vulnerable to the security issue. After further research, Samba developers have confirmed that only Samba 3.0.2a and earlier releases contain the exploitable code.

A vulnerability has been discovered in samba, a commonly used LanManager-like file and printer server for Unix. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for the connection, though.

Updated samba packages that fix an input validation vulnerability are now available.

Samba provides file and printer sharing services to SMB/CIFS clients.

Karol Wiesek discovered an input validation issue in Samba prior to 3.0.6. An authenticated user could send a carefully crafted request to the Samba server, which would allow access to files outside of the configured file share. Note: Such files would have to be readable by the account used for the connection. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0815 to this issue.

This issue does not affect Red Hat Enterprise Linux 3 as a previous erratum updated to Samba 3.0.6 which is not vulnerable to this issue.

Users of Samba should upgrade to these updated packages, which contain an upgrade to Samba-2.2.12, which is not vulnerable to this issue.

The remote host is missing the patch for the advisory SUSE-SA:2004:035 (samba).


The Samba server, which allows to share files and resources via the SMB/CIFS protocol, contains a bug in the sanitation code of path names which allows remote attackers to access files outside of the defined share. In order to access these files, they must be readable by the account used for the SMB session.
CVE-2004-0815 has been assigned to this issue.

Karol Wiesek discovered a bug in the input validation routines used to convert DOS path names to path names on the Samba host's file system.
This bug can be exploited to gain access to files outside of the share's path as defined in the smb.conf configuration file. This vulnerability exists in all samba 2.2.x versions up to and including 2.2.11 and also in samba 3.0.x up to and including 3.0.5.

The updated packages have been patched to correct this issue.

The remote Samba server, according to its version number, may be vulnerable to a remote file access vulnerability.
 This vulnerability may allow an attacker to access arbitrary files that exist outside of the share's defined path.
An attacker needs a valid account to exploit this vulnerability. 

According to its version number, the remote Samba server is affected by a flaw that allows an attacker to access arbitrary files which exist outside of the shares's defined path.  An attacker needs a valid account to exploit this flaw.

ID	Name	Product	Family	Severity
19144	FreeBSD : samba -- remote file disclosure (de16b056-132e-11d9-bc4a-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	high
15690	Debian DSA-600-1 : samba - arbitrary file access	Nessus	Debian Local Security Checks	high
15428	RHEL 2.1 : samba (RHSA-2004:498)	Nessus	Red Hat Local Security Checks	high
15423	SUSE-SA:2004:035: samba	Nessus	SuSE Local Security Checks	high
15413	Mandrake Linux Security Advisory : samba (MDKSA-2004:104)	Nessus	Mandriva Local Security Checks	high
2338	Samba < 3.0.6 Remote Arbitrary File Access	Nessus Network Monitor	Samba	medium
2337	Samba < 2.2.11 Remote Arbitrary File Access	Nessus Network Monitor	Samba	medium
15394	Samba MS-DOS Path Request Arbitrary File Retrieval	Nessus	Misc.	medium

Detections

Analytics

CVE-2004-0815

critical

Tenable Plugins

high

high

high

high

high

medium

medium

medium