Prepare to patch a critical flaw in Windows and Samba file sharing in 3 weeks

The Badlock vulnerability is severe and likely to be exploited soon after disclosure

Systems administrators should get ready to fix a critical vulnerability on April 12 that affects the Windows and Samba implementations of the Server Message Block (SMB) protocol.

The vulnerability was discovered by Stefan Metzmacher, a core developer of the Samba software, which is a popular open-source implementation of the SMB/CIFS (Server Message Block/Common Internet File System) networking protocol.

SMB/CIFS is implemented by default in Windows, where it's used for network file and printer sharing. Linux and other Unix-like systems can interoperate and share resources with Windows systems over the same protocol using the Samba software.

"On April 12th, 2016, SerNet, the Samba Team and Microsoft will disclose a severe bug that affects almost all versions of Microsoft Windows and Samba," said SerNet, the company where Metzmacher works, in an announcement on its website. "The bug is called 'Badlock'."

The company, which offers Samba consulting, support and development services, has even set up an website at badlock.org where more details will be released about the flaw on the disclosure date, which coincides with Microsoft's Patch Tuesday -- the day when Microsoft releases its monthly security updates.

"Please get yourself ready to patch all systems on this day," a warning on the badlock.org website reads. "We are pretty sure that there will be exploits soon after we publish all relevant information."

There's been a bit of speculation on Twitter from members of the security community about where the flaw might be. The name itself seems to suggest that it's related to the client lock-handling mechanism, and there's actually file in the Samba source code called lock.c that has a copyright  by Stefan Metzmacher.

Because the vulnerability affects both Samba and Windows, which are separate implementations of the protocol, there's a good chance that it's actually a protocol design flaw.

"With both vendors apparently offering patches, it suggests the vulnerability is either within the integration between the two vendors, the separate implementations by each vendor, or in the SMB/CIFS protocol itself (we’re betting on the latter)," said Brian Martin, director of vulnerability intelligence at security firm Risk Based Security, in a blog post.

As far as the impact of the vulnerability goes, Johannes Loxen, the CEO of SerNet, said on Twitter that "#badlock means admin accounts for everyone on the same LAN." The message appears to have since been deleted, but a CSO article on the controversy over SerNet's use of the flaw for marketing purposes includes a screenshot of it.

The disclosure of the bug's existence, even without specific technical details, three weeks in advance has also been criticized by some members of the security community because it gives potential hackers ample time to find it on their own.

"Odds on the details of Badlock leaking (or being independently discovered) before April 12th? 15/1," said renowned security researcher David Litchfield in a Twitter message.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?