LCE events related to Samba and SMB activity are listed to detect changes or anomalies over time. Samba and SMB vulnerabilities are listed by severity to focus remediation efforts. Vulnerabilities specifically related to Badlock are identified by CVE. Network subnets that have Samba or SMB detections are listed to help prioritize areas of the network for vulnerability remediation.

A set of indicators displays alerts when SMB or Samba services are detected. The components in this dashboard provide insight into vulnerabilities, events, and detections related to Samba and Microsoft Windows SMB. Even after updating, events and vulnerabilities should be closely monitored to identify and respond to suspicious activity on systems using Samba or Microsoft Windows SMB. Any outdated versions of SMB or Samba should be updated to ensure that security patches can be properly applied. Outstanding vulnerabilities should be remediated to reduce the likelihood of compromise, and the new patches from Microsoft and Samba should be applied to all systems affected. The Badlock Discovery dashboard can assist organizations with identifying hosts and vulnerabilities related to Microsoft Windows SMB and Samba. The release of details about the Badlock vulnerability was carefully coordinated to ensure that the patches to remediate the vulnerability were available as soon as the vulnerability was disclosed All Windows and Samba systems should be updated with the newly released patches and closely monitored for suspicious activity. Badlock is a critical security bug affecting Windows and Samba, which exposes systems to man-in-the-middle and denial of service attacks.

On April 12, 2016, Microsoft and the Samba Core Team disclosed details about the Badlock vulnerability.

How to use nessus badlock detection