Attachment 18917 Details for Bug 16033 – Patch for 4.23

[patch] Patch for 4.23

CVE-2026-4480-printing-rce-v4.23-01.patch (text/plain), 1.46 KB, created by Volker Lendecke on 2026-03-25 08:34:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Volker Lendecke

Created: 2026-03-25 08:34:45 UTC

Size: 1.46 KB

patch

obsolete

>From 1573471a88ce085e8937e6c16b2ada290073596c Mon Sep 17 00:00:00 2001
>From: Volker Lendecke <vl@samba.org>
>Date: Sun, 15 Mar 2026 19:15:14 +0100
>Subject: [PATCH] CVE-2026-4480: printing: Shell-sanitize jobname passed as %J
> to "print command"
>
>Fix an unauthenticated remote code execution vulnerability with
>printing set to anything *but* cups and iprint, for example "lprng",
>so that "print command" is executed upon job submission. If the
>client-controlled job name is handed to the "print command" via "%J",
>rpcd_spoolssd passes this to the shell without escaping critical
>characters.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=16033
>Signed-off-by: Volker Lendecke <vl@samba.org>
>---
> source3/printing/print_generic.c | 15 ++++++++++-----
> 1 file changed, 10 insertions(+), 5 deletions(-)
>
>diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c
>index 7c7a14de045..c021fd1bcef 100644
>--- a/source3/printing/print_generic.c
>+++ b/source3/printing/print_generic.c
>@@ -255,12 +255,17 @@ static int generic_job_submit(int snum, struct printjob *pjob,
> 		return -1;
> 	}
> 
>-	jobname = talloc_strdup(ctx, pjob->jobname);
>-	if (!jobname) {
>-		ret = -1;
>-		goto out;
>+	{
>+		char *name = escape_shell_string(pjob->jobname);
>+		if (name == NULL) {
>+			ret = -1;
>+			goto out;
>+		}
>+
>+		jobname = talloc_string_sub(ctx, name, "'", "_");
>+		SAFE_FREE(name);
> 	}
>-	jobname = talloc_string_sub(ctx, jobname, "'", "_");
>+
> 	if (!jobname) {
> 		ret = -1;
> 		goto out;
>-- 
>2.34.1
>

Actions: View

Attachments on bug 16033: 18903 | 18905 | 18915 | 18916 | 18917 | 18918 | 18919 | 18925 | 18962 | 18968 | 18969 | 18972 | 18973 | 18974 | 18975