4 ms·

I'm ambivalent towards the hype. The web site is nothing to do with the Samba Team. Having said that, this is an important enough bug that lots of vendors need

I'm ambivalent towards the hype. The web site is nothing to do with the Samba Team. Having said that, this is an important enough bug that lots of vendors need to patch immediately, and the website really helped let them know that they needed to address this as soon as possible. Could it have been handled better ? Maybe, but you get back to me after you've coordinated security disclosure for 15+ major product vendors and give me some tips :-).

raesene9 11y ago
Sorry I must have missed the bit where I impuned the rollout of the issue, or suggested I could have done it better? My comment related to the hype surrounding this bug, which I see (from an infosec point) as a bad thing. From https://www.samba.org/samba/history/security.html https://www.samba.org/samba/history/security.html it looks like there were 8 CVEs for bugs in samba this month and 14 in Microsoft's monthly patch bulletin (https://technet.microsoft.com/library/security/ms16-apr https://technet.microsoft.com/library/security/ms16-apr) Should all of those have logos and websites...? Do the other issues in these releases not need to be fixed...? So why is it a bad thing? Well to me it contributes to "vulnerability fatigue". the more issues that get hyped up and then don't turn out to be objectively more serious than many other issues that are getting release, the more people will dismiss efforts to draw attention to issues that come up.
- jra_samba 11y ago
  This is the first DCE RPC protocol level vulnerability I'm aware of. DCE RPC isn't the web, but millions of businesses depend on it (mostly unknowingly) to do admin on their local networks every day. Not trying to mitigate someone else's hype, but from the Samba point of view this is one of the most serious bugs we've ever had to fix I think. We've had worse bugs that only affected Samba (root-level compromises, shudder), but the effect of this one is the most widespread.
  - tptacek 11y ago
    I'm not writing this to be argumentative, but to get a better idea of what you mean by "protocol level vulnerability". Do you mean, "vulnerability intrinsic in the DCE RPC protocol, and not in the application layer functionality on top of it"? Because, didn't the Welchia worm target DCE RPC?
    - jra_samba 11y ago
      I mean intrinsic to the "bind" authentication part of the DCE RPC protocol. Because the connection level part of that isn't integrity protected then any mitm can downgrade it.
dsp1234 11y ago
this is an important enough bug that lots of vendors need to patch immediately, I'm curious who those vendors are that have trivially MitM'able networks.
- jra_samba 11y ago
  It's not the vendors, it's their customers :-).
deleted 11y ago
[deleted]

raesene9 11y ago

Sorry I must have missed the bit where I impuned the rollout of the issue, or suggested I could have done it better? My comment related to the hype surrounding this bug, which I see (from an infosec point) as a bad thing. From https://www.samba.org/samba/history/security.html https://www.samba.org/samba/history/security.html it looks like there were 8 CVEs for bugs in samba this month and 14 in Microsoft's monthly patch bulletin (https://technet.microsoft.com/library/security/ms16-apr https://technet.microsoft.com/library/security/ms16-apr) Should all of those have logos and websites...? Do the other issues in these releases not need to be fixed...? So why is it a bad thing? Well to me it contributes to "vulnerability fatigue". the more issues that get hyped up and then don't turn out to be objectively more serious than many other issues that are getting release, the more people will dismiss efforts to draw attention to issues that come up.

jra_samba 11y ago
This is the first DCE RPC protocol level vulnerability I'm aware of. DCE RPC isn't the web, but millions of businesses depend on it (mostly unknowingly) to do admin on their local networks every day. Not trying to mitigate someone else's hype, but from the Samba point of view this is one of the most serious bugs we've ever had to fix I think. We've had worse bugs that only affected Samba (root-level compromises, shudder), but the effect of this one is the most widespread.
- tptacek 11y ago
  I'm not writing this to be argumentative, but to get a better idea of what you mean by "protocol level vulnerability". Do you mean, "vulnerability intrinsic in the DCE RPC protocol, and not in the application layer functionality on top of it"? Because, didn't the Welchia worm target DCE RPC?
  - jra_samba 11y ago
    I mean intrinsic to the "bind" authentication part of the DCE RPC protocol. Because the connection level part of that isn't integrity protected then any mitm can downgrade it.

dsp1234 11y ago

this is an important enough bug that lots of vendors need to patch immediately, I'm curious who those vendors are that have trivially MitM'able networks.

jra_samba 11y ago
It's not the vendors, it's their customers :-).

deleted 11y ago

[deleted]