Samba: a registered name became a shell command

Samba lets a Linux or Unix machine act as a Windows file server or domain controller. A domain controller is the server that manages the logins and computers of a network. One of its older services is WINS, which keeps a table of short computer names and their network addresses. These short names are called NetBIOS names, and computers register them by sending WINS a message.

An administrator can set a WINS hook. This is a program that Samba runs each time the table changes, so that another system can keep a copy. Samba starts the hook through a shell. A shell is the program that reads a command line, splits it into words and runs it.

# winsdb.c: a computer registers a name.
winsdb_add(record, hook_script):
    table.insert(record)
    wins_hook(record, "add", hook_script)

# wins_hook.c
wins_hook(record, action, script):
    if script is empty:
        return

    # record.name came from the network.
    cmd = format("%s %s %s %02x %ld",
                 script, action,
                 record.name, record.type,
                 record.expire_time)
    for address in record.addresses:
        cmd = cmd + " " + address

    # In a child process:
    exec("/bin/sh", "-c", cmd)

In the pseudocode, winsdb_add stores a new name and calls wins_hook. That function puts the hook's path, the action, the name and the other fields into one string, with spaces between them. It then gives the string to the shell. Nothing in that string records where the name starts and ends.

That boundary matters because the shell gives some characters a special meaning. Even a space does this. A name such as OFFICE PC would reach the hook as two words and not one. A space only confuses the hook, but other characters tell the shell to start another command. So the text of a name can decide what the server runs.

This is command injection, where input meant as data gets read as part of a command. WINS names have a limit of 15 characters, and this did not prevent it. Length says how much text a field holds. It does not say how the next program will read that text.

The Samba advisory says that no login is needed, and the resulting commands run as the Samba process. The flaw needs three settings together: a domain controller, WINS support turned on, and a WINS hook set. WINS support is off by default, and other server roles use different WINS code.

AISLE reports AI discovery, and Samba credits its researcher Igor Morgenstern. Samba released fixes in versions 4.23.2, 4.22.5 and 4.21.9.