Critical Samba flaw enables remote code execution on Samba servers running as Active Directory domain controllers
Take action: If you're running Samba as an Active Directory domain controller with WINS support and a custom 'wins hook' script enabled, either disable wins hook or upgrade to Samba versions 4.23.2, 4.22.5, or 4.21.9 ASAP. The vulnerability allows command injection in a very weird scenario of using Wins and wins hook. You don't really need wins hook, and it will expose you to being hacked.
Learn More
Security researchers are reporting a critical command injection vulnerability in Samba that could allow unauthenticated attackers to achieve complete remote code execution on Samba servers running as Active Directory domain controllers.
Samba is the open-source implementation of the SMB/CIFS networking protocol used in Linux and Unix environments to mimic Windows file sharing and authentication. The vulnerability affects organizations running Samba as an Active Directory domain controller.
The vulnerability is tracked as CVE-2025-10230 (CVSS score 10.0) and affects all Samba versions since 4.0. The vulnerability requires specific configuration:
- The Samba Server needs to run as Active Directory domain controller. 'member' or 'standalone' servers use a different WINS server that is not vulnerable
- WINS support is active
- a custom 'wins hook' script in the smb.conf file.
The WINS server used by the Samba Active Directory Domain Controller does not validate the names passed to the wins hook program, and it passed them by inserting them into a string run by a shell. Because the WINS server passes names directly into a shell command, an attacker can craft a malicious NetBIOS name containing shell metacharacters whih trigger the execution of arbitrary commands with system-level privileges.
By default, wins support is disabled, but many administrators enable it to integrate legacy applications.
Samba maintainers released updated versions: 4.23.2, 4.22.5, and 4.21.9. Organizations running vulnerable configurations should patch ASAP.
Administrators should avoid setting the 'wins hook' parameter in the smb.conf of a Samba AD Domain Controller. Removing or disabling the wins hook parameter provides an effective workaround, as long as WINS support remains enabled. Alternatively, disabling WINS support altogether (wins support = no) restores default safe behavior, but this may disrupt legacy name resolution.
The 'wins hook' parameter is unlikely to be useful on a domain controller, and administrators who use it might want to reconsider that choice even on a patched server.
