Important: samba security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4480: Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. This leads to a remote code execution vulnerability. Print servers configured with "printing = cups" or "printing = iprint", and print servers that do not have the %J substitution character in the "print command" setting are not affected. The problem is much less dangerous if %J has single quotes directly around it, e.g. '%J', but it's still possible to inject command line options. By default, print servers allow guest users to print. CVE-2026-4408: Samba file servers and classic (non-AD) domain controllers offer the SamValidatePasswordChange and SamValidatePasswordReset RPC services on the SAMR DCE/RPC service when running over NCACN_IP_TCP. Both services pass a username and password to the "check password script" that can be configured in smb.conf. If the "check password script" is configured with the %u substitution character, the client-controlled username is passed to the "check password script" without escaping shell meta-characters, leading to a remote command execution vulnerability. This is a non-standard configuration in several ways: It affects Samba file servers and classic (non-AD) domain controllers that have the "check password script" configured with the %u substitution character. Active Directory Domain Controllers are not affected, they do not expand the username via the %u substitution character. The problem is much less dangerous if %u has single quotes directly around it, e.g. '%u', but it's still possible to inject command line options. Standard Samba file servers and classic domain controllers are also only affected if the samba-dcerpcd service is started as a system service, which can only happen if "rpc start on demand helpers" is set to the non-default setting "no". In the default configuration for DCE/RPC, smbd starts the samba-dcerpcd in a way that makes the vulnerable code inaccessible. CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server