The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Jul/13/20

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Jul/13/20

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Oct/14/19

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Oct/14/19

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Nov/09/17

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Apr/17/17

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Aug/11/16

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Mar/10/16

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Apr/13/15

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Sep/13/14

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : May/17/14

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Feb/15/14

SunOS 5.10_x86: Samba patch.
Date this patch was last updated by Sun : Jan/14/14

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Nov/09/17

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Apr/17/17

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Aug/11/16

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Mar/10/16

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Apr/13/15

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Sep/13/14

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : May/17/14

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Feb/15/14

SunOS 5.10: Samba patch.
Date this patch was last updated by Sun : Jan/14/14

Karol Wiesek at iDEFENSE reports :

A remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters.

Although samba.org classifies this as a DoS vulnerability, several members of the security community believe it may be exploitable for arbitrary code execution.

Karol Wiesek discovered a Denial of Service vulnerability in samba. A flaw in the input validation routines used to match filename strings containing wildcard characters may allow a remote user to consume more than normal amounts of CPU resources, thus impacting the performance and response of the server. In some circumstances the server can become entirely unresponsive.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba packages that fix various security vulnerabilities are now available.

Samba provides file and printer sharing services to SMB/CIFS clients.

During a code audit, Stefan Esser discovered a buffer overflow in Samba versions prior to 3.0.8 when handling unicode filenames. An authenticated remote user could exploit this bug which may lead to arbitrary code execution on the server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0882 to this issue. Red Hat believes that the Exec-Shield technology (enabled by default since Update 3) will block attempts to remotely exploit this vulnerability on x86 architectures.

Additionally, a bug was found in the input validation routines in versions of Samba prior to 3.0.8 that caused the smbd process to consume abnormal amounts of system memory. An authenticated remote user could exploit this bug to cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0930 to this issue.

Users of Samba should upgrade to these updated packages, which contain backported security patches, and are not vulnerable to these issues.

The remote host is missing the patch for the advisory SUSE-SA:2004:040 (samba).


There is a problem in the Samba file sharing service daemon, which allows a remote user to have the service consume lots of computing power and potentially crash the service by querying special wildcarded filenames.

This attack can be successful if the Samba daemon is running and a remote user has access to a share (even read only).

The Samba team has issued the new Samba version 3.0.8 to fix this problem, this update backports the relevant patch.

This issue has been assigned the Mitre CVE ID CVE-2004-0930.


Stefan Esser found a problem in the Unicode string handling in the Samba file handling which could lead to a remote heap buffer overflow and might allow remote attackers to inject code in the smbd process.

This issue has been assigned the Mitre CVE ID CVE-2004-0882.


We provide updated packages for both these problems.

The Samba version 2 packages are not affected by this problem.

The remote Samba server, according to its version number, is affected by a remote denial of service vulnerability as well as a buffer overflow. 

The Wild Card DoS vulnerability may allow an attacker to make the remote server consume excessive CPU cycles. 

The QFILEPATHINFO Remote buffer overflow vulnerability may allow an attacker to execute code on the server. 

An attacker needs a valid account or enough credentials to exploit those flaws.

Karol Wiesek discovered a bug in the input validation routines in Samba 3.x used to match filename strings containing wildcard characters. This bug may allow a user to consume more than normal amounts of CPU cycles which would impact the performance and response of the server. In some cases it could also cause the server to become entirely unresponsive.

The updated packages are patched to prevent this problem with patches from the Samba team. This vulnerability is fixed in samba 3.0.8.

The remote host is affected by the vulnerability described in GLSA-200411-21 (Samba: Multiple vulnerabilities)

    Samba fails to do proper bounds checking when handling     TRANSACT2_QFILEPATHINFO replies. Additionally an input validation flaw     exists in ms_fnmatch.c when matching filenames that contain wildcards.
  Impact :

    An attacker may be able to execute arbitrary code with the permissions     of the user running Samba. A remote attacker may also be able to cause     an abnormal consumption of CPU resources, resulting in slower     performance of the server or even a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Samba server, according to its version number, may be vulnerable to a remote Denial Of Service vulnerability and a remote buffer overflow.
 The Wild Card DoS vulnerability may allow an attacker to make the remote server consume excessive CPU cycles.
The QFILEPATHINFO remote buffer overflow vulnerability may allow an attacker to execute code on the server.
 An attacker needs credentials to exploit those flaws. 

ID	Name	Product	Family	Severity
138426	Solaris 10 (x86) : 119758-45	Nessus	Solaris Local Security Checks	critical
138420	Solaris 10 (sparc) : 119757-45	Nessus	Solaris Local Security Checks	critical
129873	Solaris 10 (x86) : 119758-44	Nessus	Solaris Local Security Checks	critical
129869	Solaris 10 (sparc) : 119757-44	Nessus	Solaris Local Security Checks	critical
107833	Solaris 10 (x86) : 119758-43	Nessus	Solaris Local Security Checks	critical
107832	Solaris 10 (x86) : 119758-38	Nessus	Solaris Local Security Checks	critical
107831	Solaris 10 (x86) : 119758-37	Nessus	Solaris Local Security Checks	critical
107830	Solaris 10 (x86) : 119758-36	Nessus	Solaris Local Security Checks	critical
107829	Solaris 10 (x86) : 119758-34	Nessus	Solaris Local Security Checks	critical
107828	Solaris 10 (x86) : 119758-33	Nessus	Solaris Local Security Checks	critical
107827	Solaris 10 (x86) : 119758-32	Nessus	Solaris Local Security Checks	critical
107826	Solaris 10 (x86) : 119758-31	Nessus	Solaris Local Security Checks	critical
107825	Solaris 10 (x86) : 119758-30	Nessus	Solaris Local Security Checks	critical
107330	Solaris 10 (sparc) : 119757-43	Nessus	Solaris Local Security Checks	critical
107329	Solaris 10 (sparc) : 119757-38	Nessus	Solaris Local Security Checks	critical
107328	Solaris 10 (sparc) : 119757-37	Nessus	Solaris Local Security Checks	critical
107327	Solaris 10 (sparc) : 119757-36	Nessus	Solaris Local Security Checks	critical
107326	Solaris 10 (sparc) : 119757-34	Nessus	Solaris Local Security Checks	critical
107325	Solaris 10 (sparc) : 119757-33	Nessus	Solaris Local Security Checks	critical
107324	Solaris 10 (sparc) : 119757-32	Nessus	Solaris Local Security Checks	critical
107323	Solaris 10 (sparc) : 119757-31	Nessus	Solaris Local Security Checks	critical
107322	Solaris 10 (sparc) : 119757-30	Nessus	Solaris Local Security Checks	critical
36259	FreeBSD : samba -- potential remote DoS vulnerability (ba13dc13-340d-11d9-ac1b-000d614f7fad)	Nessus	FreeBSD Local Security Checks	medium
20637	Ubuntu 4.10 : samba vulnerability (USN-22-1)	Nessus	Ubuntu Local Security Checks	medium
15741	RHEL 2.1 / 3 : samba (RHSA-2004:632)	Nessus	Red Hat Local Security Checks	critical
15726	SUSE-SA:2004:040: samba	Nessus	SuSE Local Security Checks	critical
15705	Samba Multiple Remote Vulnerabilities	Nessus	Misc.	high
15699	Mandrake Linux Security Advisory : samba (MDKSA-2004:131)	Nessus	Mandriva Local Security Checks	medium
15696	GLSA-200411-21 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
2397	Samba < 3.0.8 Remote Wild Card DoS and QFILEPATHINFO Remote Overflow	Nessus Network Monitor	Samba	high

Detections

Analytics

CVE-2004-0930

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical

critical

high

medium

critical

high