Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2025-10230

Опубликовано: 07 нояб. 2025
Источник: ubuntu
Приоритет: medium
EPSS Низкий
CVSS3: 10

Описание

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

РелизСтатусПримечание
devel

released

2:4.22.3+dfsg-4ubuntu2.1
esm-infra-legacy/trusty

released

2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15
esm-infra/bionic

released

2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3
esm-infra/focal

released

2:4.15.13+dfsg-0ubuntu0.20.04.8+esm1
esm-infra/xenial

released

2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4
jammy

released

2:4.15.13+dfsg-0ubuntu1.10
noble

released

2:4.19.5+dfsg-4ubuntu9.4
plucky

released

2:4.21.4+dfsg-1ubuntu3.5
questing

released

2:4.22.3+dfsg-4ubuntu2.1
upstream

needs-triage

Показывать по

EPSS

Процентиль: 58%
0.00373
Низкий

10 Critical

CVSS3

Связанные уязвимости

CVSS3: 10
nvd
2 месяца назад

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

CVSS3: 10
debian
2 месяца назад

A flaw was found in Samba, in the front-end WINS hook handling: NetBIO ...

CVSS3: 10
github
2 месяца назад

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

CVSS3: 10
fstec
3 месяца назад

Уязвимость реализации сервера разрешения имён WINS пакета программ сетевого взаимодействия Samba, позволяющая нарушителю выполнить произвольный код

suse-cvrf
около 2 месяцев назад

Security update for samba

EPSS

Процентиль: 58%
0.00373
Низкий

10 Critical

CVSS3