Prepare to patch a critical flaw in Windows and Samba file sharing in 3 weeks

The Badlock vulnerability is severe and likely to be exploited soon after disclosure

Systems administrators should get ready to fix a critical vulnerability on April 12 that affects the Windows and Samba implementations of the Server Message Block (SMB) protocol.

The vulnerability was discovered by Stefan Metzmacher, a core developer of the Samba software, which is a popular open-source implementation of the SMB/CIFS (Server Message Block/Common Internet File System) networking protocol.

SMB/CIFS is implemented by default in Windows, where it's used for network file and printer sharing. Linux and other Unix-like systems can interoperate and share resources with Windows systems over the same protocol using the Samba software.

"On April 12th, 2016, SerNet, the Samba Team and Microsoft will disclose a severe bug that affects almost all versions of Microsoft Windows and Samba," said SerNet, the company where Metzmacher works, in an announcement on its website. "The bug is called 'Badlock'."

The company, which offers Samba consulting, support and development services, has even set up an website at badlock.org where more details will be released about the flaw on the disclosure date, which coincides with Microsoft's Patch Tuesday -- the day when Microsoft releases its monthly security updates.

"Please get yourself ready to patch all systems on this day," a warning on the badlock.org website reads. "We are pretty sure that there will be exploits soon after we publish all relevant information."

There's been a bit of speculation on Twitter from members of the security community about where the flaw might be. The name itself seems to suggest that it's related to the client lock-handling mechanism, and there's actually file in the Samba source code called lock.c that has a copyright  by Stefan Metzmacher.

Because the vulnerability affects both Samba and Windows, which are separate implementations of the protocol, there's a good chance that it's actually a protocol design flaw.

"With both vendors apparently offering patches, it suggests the vulnerability is either within the integration between the two vendors, the separate implementations by each vendor, or in the SMB/CIFS protocol itself (we’re betting on the latter)," said Brian Martin, director of vulnerability intelligence at security firm Risk Based Security, in a blog post.

As far as the impact of the vulnerability goes, Johannes Loxen, the CEO of SerNet, said on Twitter that "#badlock means admin accounts for everyone on the same LAN." The message appears to have since been deleted, but a CSO article on the controversy over SerNet's use of the flaw for marketing purposes includes a screenshot of it.

The disclosure of the bug's existence, even without specific technical details, three weeks in advance has also been criticized by some members of the security community because it gives potential hackers ample time to find it on their own.

"Odds on the details of Badlock leaking (or being independently discovered) before April 12th? 15/1," said renowned security researcher David Litchfield in a Twitter message.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?