Attachment 18905 Details for Bug 16033 – Initial advisory, CVE number pending

Initial advisory, CVE number pending

16033.txt (text/plain), 1.70 KB, created by Volker Lendecke on 2026-03-18 12:31:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-03-18 12:31:48 UTC

Size: 1.70 KB

patch

obsolete

>===========================================================
>== Subject:     Unauthenticated Remote Code Execution
>==		in Samba printing subsystem
>==
>== CVE ID#:     
>==
>== Versions:    All versions
>==
>== Summary:     Samba print servers with a "print command"
>==		that has the "%J" substitution character
>==		are vulnerable to a Remote Code Execution
>===========================================================
>
>===========
>Description
>===========
>
>Samba passes the client-controlled job description string to the
>command configured with the "print command" setting via the "%J"
>substitution character without escaping shell meta characters. This
>leads to a remote code execution vulnerability.
>
>Print servers configured with "printing = cups" or "printing =
>iprint", and print servers that do not have the "%J" substitution
>character in the "print command" setting are not affected.
>
>By default, print servers allow guest users to print.
>
>==================
>Patch Availability
>==================
>
>Patches addressing this issue have been posted to:
>
>    https://www.samba.org/samba/security/
>
>Additionally, Samba $VERSIONS have been issued
>as security releases to correct the defect.  Samba administrators are
>advised to upgrade to these releases or apply the patch as soon
>as possible.
>
>==================
>CVSSv3 calculation
>==================
>
>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 10.0
>
>==========
>Workaround
>==========
>
>Remove "%J" from the "print command" smb.conf entry.
>
>=======
>Credits
>=======
>
>Originally reported by Ron Ben Yizhak with SafeBreach
>
>==========================================================
>== Our Code, Our Bugs, Our Responsibility.
>== The Samba Team
>==========================================================
>

Flags:

dbagnall: review+

Actions: View

Attachments on bug 16033: 18903 | 18905 | 18915 | 18916 | 18917 | 18918 | 18919 | 18925 | 18962 | 18968 | 18969 | 18972 | 18973 | 18974 | 18975