CVE-2004-0186: High severity Samba Samba vulnerability
Published Mar 15, 2004
·Updated
smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted.
Affected Software
17 affected components
Samba Samba=3.0.0
Samba Samba=2.0
Linux Linux kernel=2.6.0-test5
Linux Linux kernel=2.6.0-test2
Linux Linux kernel=2.6_test9_cvs
Linux Linux kernel=2.6.0-test11
Linux Linux kernel=2.6.1-rc2
Linux Linux kernel=2.6.0-test1
Linux Linux kernel=2.6.0-test6
Linux Linux kernel=2.6.0-test4
Linux Linux kernel=2.6.0
Linux Linux kernel=2.6.0-test10
Linux Linux kernel=2.6.0-test9
Linux Linux kernel=2.6.1-rc1
Linux Linux kernel=2.6.0-test7
Linux Linux kernel=2.6.0-test8
Linux Linux kernel=2.6.0-test3
Remediation
Patch Available
Patch Available
Event History
Mar 15, 2004
CVE Published
05:00 AM
Sep 1, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0186?
CVE-2004-0186 has a high severity rating as it allows local users to gain root privileges on the system.
2
How do I fix CVE-2004-0186?
To fix CVE-2004-0186, ensure that the 'smbmnt' program is not setuid or update to a patched version of Samba.
3
Which versions of Samba are affected by CVE-2004-0186?
CVE-2004-0186 affects Samba 2.x and 3.0.0 versions when running on Linux kernel 2.6.
4
Can CVE-2004-0186 be exploited remotely?
No, CVE-2004-0186 can only be exploited locally by users who can mount Samba shares.
5
What Linux versions are impacted by CVE-2004-0186?
CVE-2004-0186 impacts Linux kernel versions 2.6.0 and its test versions.