SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Badlock : A Critical Samba Vulnerability

Badlock : A Critical Samba Vulnerability

A critical vulnerability found in Samba which affects all Windows platforms, termed as badlock. It will be patched on April 12, 2016. This is called samba badlock vulnerability. A vulnerability management tool can mitigate this vulnerability.

Mar 23, 2016By Kumarswamy S2 min read

A critical vulnerability found in Samba which affects all Windows platforms, termed as badlock. It will be patched on April 12, 2016. This is called samba badlock vulnerability. A vulnerability management tool can mitigate this vulnerability.

credit : badlock.org
credit : badlock.org

Samba is an open source implementation of the SMB/CIFS network protocol, which runs on non-windows operating systems like Unix, IBM System 390, Linux, OpenVMS and other operating systems and allows them to interact with Microsoft Windows to access files and printer over a network. Also, a auto patching solution can patch this vulnerability.

Samba Badlock vulnerability discovered by Stefan Metzmacher, a member of the international Samba Core Team and works at SerNet on Samba. However, he reported the bug to Microsoft and has been working with them to bring out the patch to badlock flaw.

From badlock.org:

plaintext
On April 12th, 2016 a crucial security bug in Windows and Samba will be disclosed. We call it: Badlock.

Engineers at Microsoft and the Samba Team are working together to  get this problem fixed. Patches will be released on April 12th.

Admins and everyone responsible for Windows or Samba server infrastructure: Mark the date. (Again: It's April 12th, 2016.)

Please get yourself ready to patch all systems on this day. We are pretty sure that there will be exploits soon after we publish all relevant information.

However some of the deleted tweets from the person registered badlock.org domain, Johannes Loxen reveal two things :

  • The reason behind disclosing the vulnerability is “SerNet gets marketing” as a side effect.
badlock_marketing
badlock_marketing
  • Another tweet is giving us clue on the impact of exploitation, which is “admin accounts for everyone on the same LAN”.

More information about this vulnerability going disclosed on Microsoft Patch Tuesday (i.e. 12th, April, 2016) by Samba Team and Microsoft.

SecPod Saner

A free vulnerability mitigation software. Build strong defense.

Kumarswamy S

badlock_admin_lan
badlock_admin_lan

Featured Posts

Open Silent Lynx Hits CIS Governments With WinRAR Flaw
threat intelligenceSilent Lynx Hits CIS Governments With WinRAR Flaw

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.

Oct 16, 2026

Open Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution
Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

CVE Research

Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

A critical vulnerability in Drupal core's Field UI module could allow attackers to execute arbitrary code on vulnerable websites through exposed contributed modules or custom code. Tracked as CVE-2026-108097, the flaw stems from improper validation of PHP callbacks during table rendering. At least one known exploitation path does not require authentication, potentially putting affected websites at risk of server compromise.

Oct 16, 2026

Open Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution
vulnerability researchPalo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

CVE Research

Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

Oct 15, 2026

Open Cisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write
vulnerability researchCisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write

CVE Research

Cisco Secure Email Gateway Under Attack: Critical CVE-2026-76519 Enables Arbitrary File Write

Oct 15, 2026