On April 12th, 2016, a crucial security bug in Windows and Samba will be disclosed. We call it: the Badlock bug.

Engineers at Microsoft and the Samba Team are working together to get this problem fixed. Patches will be released on April 12th.

Admins and all of you responsible for Windows or Samba server infrastructure: Mark the date. (Again: It’s April 12th, 2016.)

Please get yourself ready to patch all systems on this day. We are pretty sure that there will be exploits soon after we publish all relevant information.

When on April 12th will the patches be released?

Patches will be released around 17:00 UTC. That’s about the same time the Microsoft Patch Tuesday occurs.

Is there a CVE for Badlock?

Yes. Badlock has an assigned CVE. It will be listed here after the patches are released.

Why announce Badlock before April 12th, 2016?

The main goal of this announcement is to give a heads up and to get you ready to patch all systems as fast as possible and have sysadmin resources available on the day the patch will be released. Vendors and distributors of Samba are being informed before a security fix is released in any case. This is part of any Samba security release process.

Weighting to the respective interests of advance warning and utmost secrecy we chose to warn you beforehand, so that everyone has a chance to be ready to install the fixes as soon as they are available. Once the patch is released to the public, it will point to attack vectors and exploits will be in the wild in no time.

Who found the Badlock Bug?

Badlock was discovered by Stefan Metzmacher. He’s a member of the international Samba Core Teamand works at SerNet on Samba. He reported the bug to Microsoft and has been working closely with them to fix the problem.

Information courtesy of badlock.org