Corrective releases of Samba 4.23.2, 4.22.5, and 4.21.9 have been published, addressing the vulnerability (CVE-2025-10230) in the WINS name resolution server implementation, which allows remote code execution on the server without authentication. The issue has been assigned the highest severity level — 10 out of 10.
The vulnerability is caused by a lack of proper validation of values passed before launching the application specified in the 'wins hook' parameter. This application is executed via the 'sh -c' command whenever a name change occurs through WINS. When using WINS in an Active Directory controller, NetBIOS names passed as command line arguments during the launch of the hook application were not sanitized of special characters, allowing arbitrary shell commands to be executed by indicating a specially crafted NetBIOS name in the request to the WINS server. domain Active Directory, NetBIOS names passed as command line arguments when launching the hook application were not sanitized for special characters, allowing arbitrary shell commands to be executed by specifying a specially crafted NetBIOS name in the request to the WINS server. cmd = talloc_asprintf(tmp_mem, "%s %s %s x %ld", wins_hook_script, wins_hook_action_string(action), rec->name->name, rec->name->type, (long int) rec->expire_time); … execl("/bin/sh", "sh", "-c", cmd, NULL);
An unauthenticated client can send a registration packet to the WINS server and request any NetBIOS name not exceeding 15 characters. The cleaning of characters such as '', and ';' is not performed on the name. Consequently, when running the hook handler, passing a name like 'name;id>file' will result in the 'id' utility being executed and its output directed to the file 'file'.
The vulnerability manifests on systems where the 'wins hook' parameter is set in smb.conf when using a domain controller with active WINS support (by default disabled and requires enabling the 'wins support = yes' parameter). If a WINS server is used in systems without a domain controller, the vulnerability does not manifest. proxy server To check the status of the new package version or patch preparation in distributions, you can visit the following pages: Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Gentoo, Arch, FreeBSD, OpenBSD, and NetBSD.
The published releases of Samba also addressed a less critical vulnerability (CVE-2025-9640) that leads to the leakage of uninitialized memory. The issue occurs in the vfs_streams_xattr module during memory allocation failures, which can be triggered by performing write operations that create empty areas in the file. This vulnerability can be exploited by an authenticated user.
Source: opennet.ru
