Prepare to patch a critical flaw in Windows and Samba file sharing in 3 weeks

The Badlock vulnerability is severe and likely to be exploited soon after disclosure

Systems administrators should get ready to fix a critical vulnerability on April 12 that affects the Windows and Samba implementations of the Server Message Block (SMB) protocol.

The vulnerability was discovered by Stefan Metzmacher, a core developer of the Samba software, which is a popular open-source implementation of the SMB/CIFS (Server Message Block/Common Internet File System) networking protocol.

SMB/CIFS is implemented by default in Windows, where it's used for network file and printer sharing. Linux and other Unix-like systems can interoperate and share resources with Windows systems over the same protocol using the Samba software.

"On April 12th, 2016, SerNet, the Samba Team and Microsoft will disclose a severe bug that affects almost all versions of Microsoft Windows and Samba," said SerNet, the company where Metzmacher works, in an announcement on its website. "The bug is called 'Badlock'."

The company, which offers Samba consulting, support and development services, has even set up an website at badlock.org where more details will be released about the flaw on the disclosure date, which coincides with Microsoft's Patch Tuesday -- the day when Microsoft releases its monthly security updates.

"Please get yourself ready to patch all systems on this day," a warning on the badlock.org website reads. "We are pretty sure that there will be exploits soon after we publish all relevant information."

There's been a bit of speculation on Twitter from members of the security community about where the flaw might be. The name itself seems to suggest that it's related to the client lock-handling mechanism, and there's actually file in the Samba source code called lock.c that has a copyright  by Stefan Metzmacher.

Because the vulnerability affects both Samba and Windows, which are separate implementations of the protocol, there's a good chance that it's actually a protocol design flaw.

"With both vendors apparently offering patches, it suggests the vulnerability is either within the integration between the two vendors, the separate implementations by each vendor, or in the SMB/CIFS protocol itself (we’re betting on the latter)," said Brian Martin, director of vulnerability intelligence at security firm Risk Based Security, in a blog post.

As far as the impact of the vulnerability goes, Johannes Loxen, the CEO of SerNet, said on Twitter that "#badlock means admin accounts for everyone on the same LAN." The message appears to have since been deleted, but a CSO article on the controversy over SerNet's use of the flaw for marketing purposes includes a screenshot of it.

The disclosure of the bug's existence, even without specific technical details, three weeks in advance has also been criticized by some members of the security community because it gives potential hackers ample time to find it on their own.

"Odds on the details of Badlock leaking (or being independently discovered) before April 12th? 15/1," said renowned security researcher David Litchfield in a Twitter message.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?