CVE-2025-10230

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

• SECURITY UPDATE: remote command execution via unsanitized WINS hook NetBIOS name handling in Samba AD DC
  • debian/patches/CVE-2025-10230.patch: validate NetBIOS names in source4 WINS hook to prevent shell metacharacter injection
  • debian/patches/CVE-2025-10230-test.patch: add torture tests for WINS hook name sanitization
  • CVE-2025-10230

• SECURITY UPDATE: command injection via improper NetBIOS name validation in shell hook handling (CVE)
  • debian/patches/CVE-2025-10230-1.patch: Validate NetBIOS names before passing them to hook shell command, rejecting characters outside alphanumeric, dot, underscore, or hyphen. Prevent command injection caused by untrusted names containing shell metacharacters.
  • debian/patches/CVE-2025-10230-2.patch: Add selftest verifying WINS hook skip invocation for registered names containing shell metacharacters; issue stem from unsafe name handling allowing hook execution with untrusted, potentially command-injecting name strings.
  • CVE-2025-10230

• SECURITY UPDATE: unauthenticated command injection via WINS hook in source4 NBT server. The "wins hook" parameter passed unsanitized NetBIOS names to a shell command, allowing arbitrary command execution by remote clients.
  • debian/patches/CVE-2025-10230.patch
  • CVE-2025-10230

An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. (CVE-2018-14628) Command injection in wins server hook script. (CVE-2025-10230) vfs_streams_xattr uninitialized memory write possible. (CVE-2025-9640)

These are all security issues fixed in the ctdb-4.22.5+git.431.dc5a539f124-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

Update to 4.22.5:

• CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
• CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

• Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087).

• Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181).

• Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180).

• don't attempt to label paths that don't exist, also remove unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
• getpwuid does not shift to new DC when current DC is down
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName-
• Unresponsive second DC can cause idmapping failure when using idmap_ad-
• kinit command is failing with Missing cache Error.
• Figuring out the DC name from IP address fails and breaks fork_domain_child().
• vfs_streams_depot fstatat broken.
• Delayed leader broadcast can block ctdb forever.
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine).
• Fix handling of empty GPO link.
• SMB ACL inheritance doesn't work for files created.

• adjust gpgme build dependency for future-proofing

Root has patched CVE-2025-10230 in the samba package for Root:Debian:12. Multiple fixed versions available.

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

Update to 4.22.5:

• CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
• CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

• Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087).

• Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181).

• Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180).

• don't attempt to label paths that don't exist, also remove unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
• getpwuid does not shift to new DC when current DC is down
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName-
• Unresponsive second DC can cause idmapping failure when using idmap_ad-
• kinit command is failing with Missing cache Error.
• Figuring out the DC name from IP address fails and breaks fork_domain_child().
• vfs_streams_depot fstatat broken.
• Delayed leader broadcast can block ctdb forever.
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine).
• Fix handling of empty GPO link.
• SMB ACL inheritance doesn't work for files created.

• adjust gpgme build dependency for future-proofing

This update for samba fixes the following issues:

Update to 4.22.5:

• CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
• CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

• Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087).

• Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181).

• Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180).

• don't attempt to label paths that don't exist, also remove unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
• getpwuid does not shift to new DC when current DC is down
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName-
• Unresponsive second DC can cause idmapping failure when using idmap_ad-
• kinit command is failing with Missing cache Error.
• Figuring out the DC name from IP address fails and breaks fork_domain_child().
• vfs_streams_depot fstatat broken.
• Delayed leader broadcast can block ctdb forever.
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine).
• Fix handling of empty GPO link.
• SMB ACL inheritance doesn't work for files created.

• adjust gpgme build dependency for future-proofing

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

Update to 4.21.8:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0; (bso#14981).
• getpwuid does not shift to new DC when current DC is down; (bso#15844).
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName; (bso#15876).
• kinit command is failing with Missing cache Error; (bso#15840).
• Figuring out the DC name from IP address fails and breaks fork_domain_child(); (bso#15891).
• Delayed leader broadcast can block ctdb forever; (bso#15892).
• 'net ads group' failed to list domain groups; (bso#15900).
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine); (bso#15663).
• Fix handling of empty GPO link; (bso#15877).
• SMB ACL inheritance doesn't work for files created; (bso#15880).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed vfs_streams_xattr uninitialized memory write (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS Server Hook Script (bsc#1251280).

Andrew Walker discovered that Samba incorrectly initialized memory in the vfs_streams_xattr module. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2025-9640)

Igor Morgenstern discovered that Samba incorrectly handled names passed to the WINS hook program. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-10230)

USN-7826-1 fixed vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

Andrew Walker discovered that Samba incorrectly initialized memory in the vfs_streams_xattr module. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2025-9640)

Igor Morgenstern discovered that Samba incorrectly handled names passed to the WINS hook program. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-10230)