===========================================================
== Subject:     Unauthenticated Remote Code Execution
==		in Samba printing subsystem
==
== CVE ID#:     
==
== Versions:    All versions
==
== Summary:     Samba print servers with a "print command"
==		that has the "%J" substitution character
==		are vulnerable to a Remote Code Execution
===========================================================

===========
Description
===========

Samba passes the client-controlled job description string to the
command configured with the "print command" setting via the "%J"
substitution character without escaping shell meta characters. This
leads to a remote code execution vulnerability.

Print servers configured with "printing = cups" or "printing =
iprint", and print servers that do not have the "%J" substitution
character in the "print command" setting are not affected.

By default, print servers allow guest users to print.

==================
Patch Availability
==================

Patches addressing this issue have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba $VERSIONS have been issued
as security releases to correct the defect.  Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 10.0

==========
Workaround
==========

Remove "%J" from the "print command" smb.conf entry.

=======
Credits
=======

Originally reported by Ron Ben Yizhak with SafeBreach

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================