Clear April 12: Windows, Samba to splat curious 'crucial' Badlock bug

Re: It's the end of the world....

As if millions of nas boxes cried out in terror and were suddenly silenced.

Re: It's the end of the world....

It was eight years ago that Microsoft gave the Samba devs all of the protocol documentation, I assume that all of the various bits of MS got the memo then and stopped trying to mess with Samba, but then who knows. There's probably a department at Microsoft that is still dedicated to bringing down Netscape.

Re: OSX?

If Microsoft is also working on a fix it is presumably a flaw in the protocol rather than the SAMBA implementation

Re: About that name thing.

You missed Apples release yesterday?

Yet another reason why of-the-shelf NAS are a bad idea, and why FreeBSD based and actively maintained FreeNAS is a much better idea.

I thought there used to be security lists that people subscribed to for this sort of thing

There still are. BUGTRAQ, for example, is still going strong.

is every vulnerability from this point forward going to have a catchy name and a website?

No. While it seems like there are a lot of these "celebrity bugs", they're really a very small fraction of public disclosures. I've received 14 emails from BUGTRAQ today. Even weekly and monthly summaries of only "major" vulnerability announcements, from various CERTs and the like, are almost entirely non-celebrity bugs.

So while we're certainly seeing more of this sort of thing, it's barely at the level of background noise to anyone who follows common vulnerability-disclosure channels.

Personally, I have no objection to the fad. While it's easy to demonstrate how cynical and cool you are by mocking it (hello, Reg scribes!), it makes it much easier to light a fire under management and inform end users. Someone's creating an easy-to-find description of the problem for non-experts? Oh, the horror.

Re: Correction

SMB is a fairly stupid protocol, but then so is NFS¹. I have decades-old paper copies of the specs for both², so it's not like my opinion is completely uninformed.

There have been some better file-sharing protocols. The Andrew File System was superior, in my book. And there have been worse ones, like AppleTalk. I don't remember enough about IPX and Novell's file-sharing protocol³, or VMS clustering, or any of the others I've seen over the years to say. I don't think any of them was an unalloyed wonder, though.

In general, blaming a protocol for how it's used just displays your ability to commit category errors.

¹NFS has gotten better over the years, but in the process it's also gotten rather stovepiped.

¹Technically, in the case of SMB, what I have is Microsoft Networks: SMB File Sharing Protocol, version 6.0p, published by Microsoft in 1996. As noted above, this is not the complete specification for SMB; for full interoperability with Windows the Samba team had to reverse-engineer a lot of proprietary additions. But it's the core, and at 99 pages a pretty significant chunk in itself.

³Which is kind of ironic, since I work for the company that now owns Novell.

Re: Home Users

Indeed. Have an upvote. I am often asked to implement a cross-platform server for home users of Windows and Macintosh computers. Samba is an obvious choice and not very difficult to enable on a wide variety of NAS devices or operating systems. Sort of thick to say that this is unlikely to affect home users.

Re: Home Users

Current versions of Windows, even the workstation versions have SMB enabled by default

I'm not sure that's true of anything after Vista, to the best of my knowledge the Windows firewall blocks SMB traffic, and the "File and Printer Sharing" and "Network Discovery" services are disabled by default.