Corrective releases for Samba versions 4.24.3, 4.23.8, and 4.22.10 have been announced, providing an open implementation of SMB and Active Directory protocols. The new versions address 6 vulnerabilities, two of which allow an unauthenticated remote attacker to execute their code on the server:
- CVE-2026-4408 is a vulnerability in the implementation of the SAMR (Security Account Manager) server over DCE/RPC, used for managing credentials and user and group databases. This issue affects file and classic domain controllers (not Active Directory) running the samba-dcerpcd process as a system service (which is not enabled by default) and using a password-checking script specified in smb.conf through the 'check password script' setting with the '%u' placeholder in the startup command (configurations without the '%u' substitution are not affected by this issue). servers The vulnerability is caused by the SamValidatePasswordChange and SamValidatePasswordReset RPC services passing the username and password to the script specified via the 'check password script' setting without escaping special characters when substituting the username through '%u'. This vulnerability allows arbitrary shell commands to be executed when a specially formatted username is provided. As a workaround, it is recommended to pass the username to the script not through the '%u' substitution but via the SAMBA_CPS_ACCOUNT_NAME environment variable.
CVE-2026-4480 is a vulnerability in the print server using the 'print command' setting with the '%J' placeholder. The problem arises because the user-specified print job description is passed through the '%J' substitution without proper escaping of special characters, allowing remote code execution when sending a print job, even in the default guest mode. As a workaround, it is suggested to remove the '%J' substitution from the 'print command' setting in smb.conf. server Several other vulnerabilities have also been addressed in the new releases, which could allow bypassing access checks for the xattr attribute 'reparse point', re-writing a file when using the vfs module WORM (Write-Once, Read Many), installing a certificate via HTTP without verification, and causing a crash of AD DC WINS by sending a specially crafted UDP packet.
- CVE-2026-4480 is a vulnerability in print server settings using the 'print command' with the placeholder '%J'. The issue arises because the user-specified print job description is passed through the '%J' substitution without proper escaping of special characters, allowing remote code execution when sending a print job, even in the default guest mode. As a workaround, the substitution can be removed.
'%J' from the 'print command' setting in smb.conf.
Additionally, several other vulnerabilities have been addressed in the new releases, including the ability to bypass access checks for the xattr attribute 'reparse point', reoverwrite a file using the WORM (Write-Once, Read Many) vfs module, install a certificate via HTTP without verification, and trigger an emergency shutdown. server AD DC WINS by sending a specially crafted UDP packet.
Source: opennet.ru
