This bug was created by Jan Engelhardt <jengelh@linux01.gwdg.de> at the SuSE
bugzilla.  As I don't care about plain passwords I feed it to Samba.org.

The original report from Jan:

The smbd refuses a (plaintext) password whose 9'th, 10'th, etc. characters are
uppersize.

(Now read reproduction)

Cause:
In [samba-3.0.4-1.14, or any minor updates]
samba-3.0.4/source/auth/pass_check.c, around line 446 in function
string_combinations2() near:

#ifdef PASSWORD_LENGTH
len = MIN(len, PASSWORD_LENGTH);
#endif

the following is happening (upon initial entrance to the function):
s = "nohohzuiW"
offset = 0
fn = ... <I don't care>
N = 9
PASSWORD_LENGTH is #defined to be 8 (found out by gdb)
Thus, len is set to 8 -- and thus only the first eight characters are probed for
upper-/lowercase, 9'th, 10'th and so on always stay lower case.

A workaround is to remove the offending three lines, though that might impact
speed, as the Samba developers tell us in include/includes.h:948 near

/* what is the longest significant password available on your system?  
 Knowing this speeds up password searches a lot */
#ifndef PASSWORD_LENGTH 
#define PASSWORD_LENGTH 8 
#endif 

Guess what... 8 chars was for DES, but MD5 and Blowfish support more. I did not
want to raise PASSWORD_LENGTH because in fact PASSWORD_LENGTH is (IMO) useless
-- the string length is anyway calculated in string_combinations2(), and if
PASSWORD_LENGTH is greater than the length of my password (it must be, otherwise
MD5/BF don't work), there is no use in the call to [using the macro] MIN().

How to reproduce:
  
Add a new user to the Shadow subsystem (i.e. /etc/passwd, /etc/shadow), giving
him a password like "nohohzuiW".
In smb.conf, encrypt passwords = no, update encrypted = no, min password length = 8
The client machine should preferably be Windows 95/98/98SE.

And I really mean Windows, because that's the only one sending plaintext
password in all-uppercase. smbclient works fine with this password.