A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | |
| Red Hat | Red Hat Enterprise Linux 6 | — | |
| Red Hat | Red Hat Enterprise Linux 7 | — | |
| Red Hat | Red Hat Enterprise Linux 8 | — | |
| Red Hat | Red Hat Enterprise Linux 9 | — | |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | |
| — | samba | < 4.21.9, 4.22.0 – < 4.21.5, 4.23.0 – < 4.23.2 |
Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.
