CVE-2004-0829 Denial of service in n/a

Medium 5.0 Published 10 Sep 2004 Updated 8 Aug 2024

Remote attackers can crash the Samba daemon by sending a specific SMB request without prior initialization, causing denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2004-0829?

CVE-2004-0829 is a medium-severity denial of service vulnerability in Samba Samba, published on 10 Sep 2004. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous FindFirstPrintChangeNotify, as demonstrated by the SMB client in Windows XP SP2.

Which versions are affected by CVE-2004-0829?

It affects 1 product.

Products include Samba Samba.

How do I fix CVE-2004-0829?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2004-0829 being exploited?

There is no known exploitation of CVE-2004-0829 in the wild and no public exploit code.

All Samba Samba vulnerabilities

Sources

Also known as DEBIAN-CVE-2004-0829, GHSA-xr8x-5cxm-p785.