Publicly available and functional proof-of-concept (PoC) code that exploits a vulnerability in the Microsoft Server Message Block 3.1.1 (SMBv3) protocol CVE-2020-0796 in unpatched systems, according to a report with CISA.
Although Microsoft disclosed and provided updates for this vulnerability in March, malicious cyber actors are targeting unpatched systems with the new PoC, according to recent open-source reports. CISA recommended in its alert to use a firewall to block SMB ports from the Internet and to apply patches to critical- and high-severity vulnerabilities as soon as possible.
This vulnerability is being referred to as “SMBGhost” and “CoronaBlue.”
The remote code execution vulnerability is in the way the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.
To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server.
To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.
The security update addresses the vulnerability by correcting how the SMBv3 protocol handles these specially crafted requests.
In addition to the fix, there are workarounds.
One is to disable SMBv3 compression, according to Microsoft Security Advisory ADV200005:
Disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below.
Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” DisableCompression -Type DWORD -Value 1 -Force
1. No reboot is needed after making the change.
2. This workaround does not prevent exploitation of SMB clients.
You can disable the workaround with the PowerShell command below.
Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” DisableCompression -Type DWORD -Value 0 -Force
Another workaround is to block inbound and outbound SMB.
Consider blocking outbound SMB connections (TCP port 445 for SMBv3) from the local network to the WAN. Also ensure that SMB connections from the Internet are not allowed to connect inbound to an enterprise LAN.
It seems attackers were going after unpatched software that was patched… Unpatched is a better word to use… Consider it changed… thanks
Should the title say “Unpatched” instead of “Patched”?