Windows Vista SMBv2签名远程代码执行漏洞(MS07-063)

2007-12-13T00:00:00
ID SSV:2581
Type seebug
Reporter Root
Modified 2007-12-13T00:00:00

Description

BUGTRAQ ID: 26777 CVE(CAN) ID: CVE-2007-5351

Microsoft Windows Vista是微软发布的非常流行的操作系统。

Windows Vista处理SMBv2的签名时存在漏洞,远程攻击者可能利用此漏洞篡改SMB数据。

Vista没有正确地实现SMBv2签名,可能允许攻击者修改SMBv2数据包,并重新计算签名。成功利用这个漏洞的攻击者可以篡改通过SMBv2传输的数据,从而在与SMBv2通信的域配置中远程执行代码。但在在Vista中SMB签名默认情况下是禁用的。

Microsoft Windows Vista 临时解决方法:

  • 禁用SMBv2,请执行下列步骤:

  • 创建一个包含下列内容的 .reg 文件:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation] "DependOnService"=hex(7):42,00,6f,00,77,00,73,00,65,00,72,00,00,00,4d,00,52, 00,78,00,53,00,6d,00,62,00,31,00,30,00,00,00,4e,00,53,00,49,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters] "Smb2"=dword:00000000

  1. 单击运行.reg文件。
  2. 以管理员身份打开命令提示符。
  3. 运行下列命令: sc config mrxsmb20 start= disabled

厂商补丁:

Microsoft

Microsoft已经为此发布了一个安全公告(MS07-063)以及相应补丁: MS07-063:Vulnerability in SMBv2 Could Allow Remote Code Execution (942624) 链接:<a href=http://www.microsoft.com/technet/security/Bulletin/MS07-063.mspx?pf=true target=_blank>http://www.microsoft.com/technet/security/Bulletin/MS07-063.mspx?pf=true</a>

补丁下载: <a href=http://www.microsoft.com/downloads/details.aspx?displaylang=zh-cn&FamilyID=9d22a9ee-cc08-4b2d-af4e-55d326f82761 target=_blank>http://www.microsoft.com/downloads/details.aspx?displaylang=zh-cn&FamilyID=9d22a9ee-cc08-4b2d-af4e-55d326f82761</a> <a href=http://www.microsoft.com/downloads/details.aspx?FamilyId=05a9501c-4da3-4fa1-901e-99cb262e5e36 target=_blank>http://www.microsoft.com/downloads/details.aspx?FamilyId=05a9501c-4da3-4fa1-901e-99cb262e5e36</a>