Description
The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.8-1 | — |
| Debian 13 | samba | 3.0.8-1 | — |
| Debian 12 | samba | 3.0.8-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | samba +3 | 3.0.7-1.3E.1 | RHSA-2004:632 |
Advisories 1
- RHSA-2004:632 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- USN-22-1 vendor-advisory
- samba-msfnmatch-dos(17987) vdb-entry
- MDKSA-2004:131 vendor-advisory
- CLA-2004:899 vendor-advisory
- 20041108 Samba SMBD Remote Denial of Service Vulnerability third-party-advisory
- 101783 vendor-advisory
- OpenPKG-SA-2004.054 vendor-advisory
- APPLE-SA-2005-03-21 vendor-advisory
- GLSA-200411-21 vendor-advisory
- 11624 vdb-entry
- SUSE-SA:2004:040 vendor-advisory
- oval:org.mitre.oval:def:10936 vdb-entry signature
- 20041108 [SECURITY] CAN-2004-0930: Potential Remote Denial of Service Vulnerability mailing-list