Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Badlock or Sadlock?

New Scan Policies, Plugins and Dashboard for CVE-2016-2118 & CVE-2016-0128

No matter which name you prefer, Badlock or Sadlock, for the recently disclosed CVE-2016-2118 (SAMR and LSA man-in-the-middle attacks possible) and for Windows by CVE-2016-0128/MS16-047 (Windows SAM and LSAD Downgrade Vulnerability) Tenable has you covered. Nessus®, SecurityCenter™, SecurityCenter CV™, or Passive Vulnerability Scanner™, Tenable can determine if you are at risk.

According to Badlock.org, the security vulnerabilities can be mostly categorized as man-in-the-middle or denial-of-service (DoS) attacks. These would permit execution of arbitrary Samba network calls using the context of the intercepted user, such as the ability to view or modify secrets within an AD database, including user password hashes, or shut down critical services or modify user permissions on files or directories. A DoS attack against the Samba service is also possible by an attacker with remote network connectivity.

Affected versions of Samba are:

  • 3.6.x
  • 4.0.x
  • 4.1.x
  • 4.2.0-4.2.9
  • 4.3.0-4.3.6
  • 4.4.0

Regardless of where you stand on the “Sadlock” discussion, if the hype warranted the naming of this vulnerability, Tenable can provide visibility into where to prioritize your remediation efforts for Badlock.

The Tenable response

Nessus

Impacted operating system vendors are making updates available. Tenable has issued a series of local and remote Nessus® plugins to detect the presence of affected versions of Samba or Windows:

MS16-047: Security Update for SAM and LSAD Remote Protocols (3148527) (Badlock)

90440

Samba 3.x < 4.2.10 / 4.2.x < 4.2.10 / 4.3.x < 4.3.7 / 4.4.x < 4.4.1 Multiple Vulnerabilities (Badlock)

90508

Samba Badlock Vulnerability

90509

MS16-047: Security Update for SAM and LSAD Remote Protocols (3148527) (Badlock) (uncredentialed check)

90510

CentOS 6 : samba (CESA-2016:0611)

90449

CentOS 6 / 7 : ipa / libldb / libtalloc / libtdb / libtevent / openchange / samba / samba4 (CESA-2016:0612)

90450

CentOS 5 : samba3x (CESA-2016:0613)

90451

CentOS 5 : samba (CESA-2016:0621)

90452

FreeBSD : samba – multiple vulnerabilities (a636fc26-00d9-11e6-b704-000c292e4fd8)

90474

Oracle Linux 6 : samba (ELSA-2016-0611)

90486

Oracle Linux 6 / 7 : samba / samba4 (ELSA-2016-0612)

90487

Oracle Linux 5 : samba3x (ELSA-2016-0613)

90488

Oracle Linux 5 : samba (ELSA-2016-0621)

90489

RHEL 6 : samba (RHSA-2016:0611)

90491

RHEL 6 / 7 : samba and samba4 (RHSA-2016:0612)

90492

RHEL 5 : samba3x (RHSA-2016:0613)

90493

RHEL 7 : samba (RHSA-2016:0618)

90495

RHEL 6 : samba (RHSA-2016:0619)

90496

RHEL 6 : samba4 (RHSA-2016:0620)

90497

RHEL 5 : samba (RHSA-2016:0621)

90498

RHEL 5 : samba (RHSA-2016:0623)

90499

RHEL 5 : samba3x (RHSA-2016:0624)

90500

Scientific Linux Security Update : samba3x on SL5.x i386/x86_64

90501

Scientific Linux Security Update : samba and samba4 on SL6.x, SL7.x i386/x86_64

90502

Scientific Linux Security Update : samba on SL5.x i386/x86_64

90503

Scientific Linux Security Update : samba on SL6.x i386/x86_64

90504

SecurityCenter

We have released a customized SecurityCenter™ dashboard to monitor, track and remediate critical assets affected by CVE-2016-2118 and CVE-2016-0128. This dashboard is automatically available via the feed to provide insight on the impact to your environment and the progress of your efforts to remediate this vulnerability.

Badlock Discovery Dashboard

SecurityCenter Continuous View detection capabilities

Note: Passive Vulnerability Scanner (PVS) is now Nessus Network Monitor. To learn more about this application and its latest capabilities, visit the Nessus Network Monitor web page.

The following LCE and PVS plugins address Badlock:

Samba < 4.2.10/11, < 4.3.7/8, < 4.4.1/2 Badlock Vulnerability

801967

Samba 4.4.x < 4.4.1 Multiple Vulnerabilities (Badlock)

9233

Samba 4.3.x < 4.3.7 Multiple Vulnerabilities (Badlock)

9232

Samba 4.2.x < 4.2.10 Multiple Vulnerabilities (Badlock)

9231