{"id":181775,"date":"2026-05-28T02:48:09","date_gmt":"2026-05-28T00:48:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah"},"modified":"2026-05-28T02:48:09","modified_gmt":"2026-05-28T00:48:09","slug":"uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah","title":{"rendered":"Vulnerabilities in Samba that allow remote code execution in rare configurations","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Corrective releases for Samba versions 4.24.3, 4.23.8, and 4.22.10 have been announced, providing an open implementation of SMB and Active Directory protocols. The new versions address 6 vulnerabilities, two of which allow an unauthenticated remote attacker to execute their code on the server:<\/p>\n<ul>\n<li class=\"l\"> CVE-2026-4408 \u2014 a vulnerability in the implementation of the SAMR (Security Account Manager) server over DCE\/RPC, used for managing credentials and databases with users and groups. The issue affects file and classic domain controllers (non-Active Directory) running the samba-dcerpcd process as a system service (which is not started by default) and using the password check script configured in smb.conf through the \"check password script\" setting utilizing the wildcard \"%u\" in the start command (configurations without the wildcard \"%u\" are not affected by this issue). <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/\" title=\"servers\" data-wpil-keyword-link=\"linked\">servers<\/a> The vulnerability is caused by the fact that the RPC services SamValidatePasswordChange and SamValidatePasswordReset pass the username and password to the script specified via the \"check password script\" setting without escaping special characters when inserting the username through \"%u\". This vulnerability allows arbitrary shell commands to be executed if a specially crafted username is provided.\n<p>As a workaround, it is suggested to pass the username to the script not through the wildcard \"%u\", but through the environment variable SAMBA_CPS_ACCOUNT_NAME. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/dts-dronten\/\" title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> CVE-2026-4480 \u2014 a vulnerability in the print server that uses the \"print command\" setting with the wildcard \"%J\". This issue arises because the user-defined description of the print job is passed through the wildcard \"%J\" without proper escaping of special characters, allowing remote execution of the user's code when sending a print job, including in the guest mode which is available by default. As a workaround, you can remove the wildcard \"%J\" from the \"print command\" setting in smb.conf.<\/p>\n<li class=\"l\"> Additionally, several other vulnerabilities have been resolved in recent releases, which allow bypassing access control checks on the xattr attribute \"reparse point\", rewriting a file again using the vfs module WORM (Write-Once, Read Many), installing a certificate via HTTP without verification, and causing a crash of AD DC WINS by sending a specially crafted UDP packet.<br \/>\nThe removal of the wildcard \"%J\" from the \"print command\" setting in smb.conf is recommended as a preventive measure.<\/p>\n<\/ul>\n<p>Furthermore, several other vulnerabilities have been addressed in the new releases. These vulnerabilities allowed bypassing access control checks for the xattr attribute \"reparse point\", rewriting a file while using the vfs module WORM (Write-Once, Read Many), installing a certificate through HTTP without verification, and triggering an unexpected shutdown of AD DC WINS via sending a specially crafted UDP packet. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/dts-los-angeles\/\" title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> AD DC WINS by sending a specially crafted UDP packet.<br \/>\n<br \/>Source: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65545\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.24.3, 4.23.8 \u0438 4.22.10, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 SMB \u0438 Active Directory. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u0432\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435: CVE-2026-4408 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 SAMR (Security Account Manager) \u043f\u043e\u0432\u0435\u0440\u0445 DCE\/RPC, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0438 \u0411\u0414 c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181775","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.24.3, 4.23.8 \u0438 4.22.10, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 SMB \u0438 Active Directory.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Samba, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u0440\u0435\u0434\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.24.3, 4.23.8 \u0438 4.22.10, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 SMB \u0438 Active Directory.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-28T00:48:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-28T00:48:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilities in Samba allow remote code execution in rare configurations | ProHoster","description":"Corrective releases of Samba package 4.24.3, 4.23.8, and 4.22.10 have been presented, providing an open implementation of the SMB and Active Directory protocols.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Samba, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u0440\u0435\u0434\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.24.3, 4.23.8 \u0438 4.22.10, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 SMB \u0438 Active Directory.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-samba-dopuskayushhie-udalyonnoe-vypolnenie-koda-v-redkih-konfiguracziyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-28T00:48:09+00:00","article:modified_time":"2026-05-28T00:48:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181775","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=181775"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181775\/revisions"}],"predecessor-version":[{"id":182098,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181775\/revisions\/182098"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=181775"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=181775"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=181775"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}