4 ms·

Sorry I must have missed the bit where I impuned the rollout of the issue, or suggested I could have done it better? My comment related to the hype surrounding

Sorry I must have missed the bit where I impuned the rollout of the issue, or suggested I could have done it better? My comment related to the hype surrounding this bug, which I see (from an infosec point) as a bad thing. From https://www.samba.org/samba/history/security.html https://www.samba.org/samba/history/security.html it looks like there were 8 CVEs for bugs in samba this month and 14 in Microsoft's monthly patch bulletin (https://technet.microsoft.com/library/security/ms16-apr https://technet.microsoft.com/library/security/ms16-apr) Should all of those have logos and websites...? Do the other issues in these releases not need to be fixed...? So why is it a bad thing? Well to me it contributes to "vulnerability fatigue". the more issues that get hyped up and then don't turn out to be objectively more serious than many other issues that are getting release, the more people will dismiss efforts to draw attention to issues that come up.

jra_samba 11y ago
This is the first DCE RPC protocol level vulnerability I'm aware of. DCE RPC isn't the web, but millions of businesses depend on it (mostly unknowingly) to do admin on their local networks every day. Not trying to mitigate someone else's hype, but from the Samba point of view this is one of the most serious bugs we've ever had to fix I think. We've had worse bugs that only affected Samba (root-level compromises, shudder), but the effect of this one is the most widespread.
- tptacek 11y ago
  I'm not writing this to be argumentative, but to get a better idea of what you mean by "protocol level vulnerability". Do you mean, "vulnerability intrinsic in the DCE RPC protocol, and not in the application layer functionality on top of it"? Because, didn't the Welchia worm target DCE RPC?
  - jra_samba 11y ago
    I mean intrinsic to the "bind" authentication part of the DCE RPC protocol. Because the connection level part of that isn't integrity protected then any mitm can downgrade it.

jra_samba 11y ago

This is the first DCE RPC protocol level vulnerability I'm aware of. DCE RPC isn't the web, but millions of businesses depend on it (mostly unknowingly) to do admin on their local networks every day. Not trying to mitigate someone else's hype, but from the Samba point of view this is one of the most serious bugs we've ever had to fix I think. We've had worse bugs that only affected Samba (root-level compromises, shudder), but the effect of this one is the most widespread.

tptacek 11y ago
I'm not writing this to be argumentative, but to get a better idea of what you mean by "protocol level vulnerability". Do you mean, "vulnerability intrinsic in the DCE RPC protocol, and not in the application layer functionality on top of it"? Because, didn't the Welchia worm target DCE RPC?
- jra_samba 11y ago
  I mean intrinsic to the "bind" authentication part of the DCE RPC protocol. Because the connection level part of that isn't integrity protected then any mitm can downgrade it.