dbcve.org
SambaApplication

CVE-2003-0196

HIGH · 10.0 CVSS v2.0 Published 2003-05-05
Patch available
A vendor patch is available. No clean upgrade release — apply the published patch.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Multiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CVE-2003-0201.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis

A detailed technical summary for this CVE is being prepared.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
SambaApplication
Affected:= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.0.9= 2.0.10= 2.2.0
Samba TngApplication
Affected:= 0.3= 0.3.1
Tru64Operating system
Affected:= 4.0b= 4.0d= 4.0d_pk9_bl17= 4.0f= 4.0f_pk6_bl17= 4.0f_pk7_bl18= 4.0g= 4.0g_pk3_bl17= 5.0= 5.0_pk4_bl17= 5.0_pk4_bl18= 5.0a
Hp UxOperating system
Affected:= 10.01= 10.20= 10.24= 11.00= 11.04= 11.11= 11.20= 11.22
SolarisOperating system
Affected:= 2.5.1= 2.6= 7.0= 8.0= 9.0
SunosOperating system
Affected:all versions= 5.5.1= 5.7= 5.8
Cifs 9000 ServerApplication
Affected:= a.01.05= a.01.06= a.01.07= a.01.08= a.01.08.01= a.01.09= a.01.09.01= a.01.09.02

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Patch available Apply the vendor patch
Vendor patch www.debian.org →
Recommended fix High confidence

Samba 2.2.8a or later (modern environments should upgrade to Samba 3.x or 4.x stable releases)

  1. 1. Identify the currently installed Samba version by running 'smbstatus --version' or 'rpm -q samba'
  2. 2. Stop all Samba services: 'smbd' and 'nmbd' processes
  3. 3. Backup the Samba configuration file (/etc/samba/smb.conf) and all Samba-related data
  4. 4. Upgrade Samba to version 2.2.8a or later (or to a current stable release such as 3.x or 4.x if compatible)
  5. 5. Verify the new Samba version is installed: 'smbstatus --version'
  6. 6. Review and restore the smb.conf configuration file as needed for the new version
  7. 7. Start Samba services and verify normal operation
Caveat Major version upgrades (2.x to 3.x/4.x) may require configuration file updates and feature changes; test thoroughly before production deployment

Generated from the published advisory — verify against the referenced sources before acting.

We can apply and verify the patch for your build — typical engagement from $1,950. Get the patch applied

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2003-0196 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2003-0196 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data