10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
Shortly after releasing its monthly batch of security updates, Microsoft late yesterday separately issued an advisory warning billions of its Windows users of a new critical, unpatched, and wormable vulnerability affecting Server Message Block 3.0 (SMBv3) network communication protocol.
It appears Microsoft originally planned to fix the flaw as part of its March 2020 Patch Tuesday update only, but, for some reason, it pulled the plug at the last minute, which apparently did not stop a tech company from accidentally leaking the existence of the unpatched flaw.
The yet-to-be patched flaw (tracked as** CVE-2020-0796**), if exploited successfully, could allow an attacker to execute arbitrary code on the target SMB Server or SMB Client.
The belated acknowledgment from Microsoft led some researchers to call the bug βSMBGhost.β
βTo exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server,β Microsoft disclosed in an advisory. βTo exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.β
Server Message Block protocol provides the basis for file sharing, network browsing, printing services, and interprocess communication over a network.
According to a now-removed Cisco Talos post, the flaw opens vulnerable systems to a βwormableβ attack, making it easy to propagate from one victim to the other.
Although itβs unclear when Microsoft plans to patch the flaw, the company is urging users to disable SMBv3 compression and block TCP port 445 on firewalls and client computers as a workaround.
Set-ItemProperty -Path βHKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parametersβ DisableCompression -Type DWORD -Value 1 -Force
Furthermore, Microsoft has cautioned that disabling SMBv3 compression will not prevent the exploitation of SMB clients.
Itβs worth pointing out that the flaw impacts only Windows 10 version 1903, Windows 10 version 1909, Windows Server version 1903, and Windows Server version 1909. But itβs possible more versions are affected as SMB 3.0 was introduced with Windows 8 and Windows Server 2012.
Despite the severity of the SMB bug, thereβs no evidence that itβs being exploited in the wild. But itβs also necessary to draw attention to the fact that this is far from the only time SMB has been exploited as an attack vector for intrusion attempts.
In the past few years alone, some of the major ransomware infections, including WannaCry and NotPetya, have been the consequence of SMB-based exploits.
For now, until Microsoft releases a security update designed to patch the CVE-2020-0796 RCE flaw, itβs recommended that the system administrators implement the workarounds to block attacks attempting to exploit the vulnerability.
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P