CVE-2004-0815

The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873Patch, Vendor Advisory
• http://marc.info/?l=bugtraq&m=109655827913457&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1
• http://us4.samba.org/samba/news/#security_2.2.12
• http://www.debian.org/security/2004/dsa-600Patch, Vendor Advisory
• http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=trueExploit, Vendor Advisory
• http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104
• http://www.novell.com/linux/security/advisories/2004_35_samba.html
• http://www.redhat.com/support/errata/RHSA-2004-498.html
• http://www.securityfocus.com/archive/1/377618
• http://www.securityfocus.com/bid/11281Patch, Vendor Advisory
• http://www.trustix.org/errata/2004/0051/
• https://bugzilla.fedora.us/show_bug.cgi?id=2102
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17556
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873Patch, Vendor Advisory
• http://marc.info/?l=bugtraq&m=109655827913457&w=2
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57664-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200529-1
• http://us4.samba.org/samba/news/#security_2.2.12
• http://www.debian.org/security/2004/dsa-600Patch, Vendor Advisory
• http://www.idefense.com/application/poi/display?id=146&type=vulnerabilities&flashstatus=trueExploit, Vendor Advisory
• http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:104
• http://www.novell.com/linux/security/advisories/2004_35_samba.html
• http://www.redhat.com/support/errata/RHSA-2004-498.html
• http://www.securityfocus.com/archive/1/377618
• http://www.securityfocus.com/bid/11281Patch, Vendor Advisory
• http://www.trustix.org/errata/2004/0051/
• https://bugzilla.fedora.us/show_bug.cgi?id=2102
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17556

Published

Nov 3, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-0809The mod_dav module in Apache 2.0.50 and earlier allows remot…
• CVE-2004-0810Buffer overflow in Netopia Timbuktu 7.0.3 allows remote atta…
• CVE-2004-0811Unknown vulnerability in Apache 2.0.51 prevents "the merging…
• CVE-2004-0812Unknown vulnerability in the Linux kernel before 2.4.23, on …
• CVE-2004-0813Unknown vulnerability in the SG_IO functionality in ide-cd a…
• CVE-2004-0814Multiple race conditions in the terminal layer in Linux 2.4.…
• CVE-2004-0816Integer underflow in the firewall logging rules for iptables…7.5
• CVE-2004-0817Multiple heap-based buffer overflows in the imlib BMP image …
• CVE-2004-0818Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2004-0819The bridge functionality in OpenBSD 3.4 and 3.5, when runnin…
• CVE-2004-0820Winamp before 5.0.4 allows remote attackers to execute arbit…
• CVE-2004-0821The CFPlugIn in Core Foundation framework in Mac OS X allows…