Executive brief
A vulnerability in Samba, a widely used software for sharing files and printers across different operating systems, could allow an attacker to take full control of a server. The issue exists in a specific password-checking feature where user-provided names are not properly cleaned before being processed by the system. If exploited, an attacker could remotely execute malicious commands, potentially leading to data theft or a complete system takeover.
Technical details
An OS command injection vulnerability (CWE-78) exists in Samba's SAMR DCE/RPC service, specifically within the SamValidatePasswordChange and SamValidatePasswordReset functions. When the 'check password script' in smb.conf uses the %u substitution character, Samba fails to escape shell meta-characters in the client-provided username before passing it to the shell. This allows unauthenticated remote attackers to achieve command execution. The vulnerability is exploitable in non-standard configurations where 'rpc start on demand helpers' is set to 'no' and the samba-dcerpcd service runs as a system service. Active Directory Domain Controllers are not affected as they do not expand the %u character in this context. Patches have been released for Samba versions 4.22, 4.23, and 4.24.
Affected products
- Samba Samba 4.1 and newer
Timeline
- 2026-03-17: other: Vulnerability reported to Samba developers
- 2026-05-26: patched: Samba releases 4.24.3, 4.23.8, and 4.22.10 containing fixes
- 2026-05-28: disclosed: Public disclosure and CVE assignment