CVE-2004-0082 Information disclosure in n/a

High 7.5 Published 1 Sep 2004 Updated 8 Aug 2024

Samba's mksmbpasswd script may use uninitialized memory for disabled accounts, allowing attackers to guess passwords and gain unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2004-0082?

CVE-2004-0082 is a high-severity vulnerability in Samba Samba, published on 1 Sep 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.

Which versions are affected by CVE-2004-0082?

It affects 1 product.

Linux distribution packages (16)

`samba` Red Hat:enterprise_linux:3::as	All versions	`0:3.0.2-6.3E`
`samba-client` Red Hat:enterprise_linux:3::as	All versions	`0:3.0.2-6.3E`
`samba-common` Red Hat:enterprise_linux:3::as	All versions	`0:3.0.2-6.3E`
`samba-swat` Red Hat:enterprise_linux:3::as	All versions	`0:3.0.2-6.3E`
`samba` Red Hat:enterprise_linux:3::desktop	All versions	`0:3.0.2-6.3E`
`samba-client` Red Hat:enterprise_linux:3::desktop	All versions	`0:3.0.2-6.3E`
`samba-common` Red Hat:enterprise_linux:3::desktop	All versions	`0:3.0.2-6.3E`
`samba-swat` Red Hat:enterprise_linux:3::desktop	All versions	`0:3.0.2-6.3E`
`samba` Red Hat:enterprise_linux:3::es	All versions	`0:3.0.2-6.3E`
`samba-client` Red Hat:enterprise_linux:3::es	All versions	`0:3.0.2-6.3E`
`samba-common` Red Hat:enterprise_linux:3::es	All versions	`0:3.0.2-6.3E`
`samba-swat` Red Hat:enterprise_linux:3::es	All versions	`0:3.0.2-6.3E`
`samba` Red Hat:enterprise_linux:3::ws	All versions	`0:3.0.2-6.3E`
`samba-client` Red Hat:enterprise_linux:3::ws	All versions	`0:3.0.2-6.3E`
`samba-common` Red Hat:enterprise_linux:3::ws	All versions	`0:3.0.2-6.3E`
`samba-swat` Red Hat:enterprise_linux:3::ws	All versions	`0:3.0.2-6.3E`

Products include Samba Samba.

How do I fix CVE-2004-0082?

Apply the vendor's patch.

Is CVE-2004-0082 being exploited?

There is no known exploitation of CVE-2004-0082 in the wild and no public exploit code.

All Samba Samba vulnerabilities

Sources

Also known as DEBIAN-CVE-2004-0082, GHSA-hwfq-3hhr-352p, RHSA-2004:064.