Today Microsoft accidentally leaked info about a new wormable vulnerability (CVE-2020-0796) in the Microsoft Server Message Block (SMB) protocol.

Today Microsoft accidentally leaked info on a security update for a wormable vulnerability in the Microsoft Server Message Block (SMB) protocol.

The issue, tracked as CVE-2020-0796, is pre- remote code execution vulnerability that resides in the Server Message Block 3.0 (SMBv3) network communication protocol, the IT giant will not address the issue as part of the March 2020 Patch Tuesday.

CVE-2020-0796 – a “wormable” SMBv3 vulnerability.Great…pic.twitter.com/E3uPZkOyQN— MalwareHunterTeam (@malwrhunterteam) March 10, 2020Technical details of the CVE-2020-0796 vulnerability have been disclosed, but security firms Cisco Talos and Fortinet published a description of the issue on their websites.

The vulnerability is caused by an error in the way SMBv3 handles maliciously crafted compressed data packets, a remote, unauthenticated attacker could exploit the flaw to execute arbitrary code within the context of the application.

“This indicates an attack attempt to exploit a Buffer Overflow Vulnerability in Microsoft SMB Servers. The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet. A remote, unauthenticated attacker can exploit this to execute arbitrary code within the context of the application.” reads the advisory published by Fortinet.

The CVE-2020-0796 vulnerability affects devices running Windows 10 Version 1903, Windows Server Version 1903 (Server Core installation), Windows 10 Version 1909, and Windows Server Version 1909 (Server Core installation). According to Fortinet other Microsoft versions should be affected.

The knowledge of the existence of a wormable flaw impacting SMB protocol is alerting the experts that fear a new wave of WannaCryand NotPetya-like attacks.

Waiting for a security update that will address the issue, experts at Cisco Talos recommend disabling SMBv3 compression and blocking the 445 TCP port on client computers and firewalls to mitigate the issue.

At the moment it appears the only way is to create a DWORD value under HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManWorkstationParameters called CompressionEnabled and set its value to 0— Niall Newman (@NiallNSec) March 10, 2020According to BleepingComputer, although an official way of disabling SMBv3 compression was not shared by Microsoft, Foregenix Solutions Architect Niall Newman was able to find after analyzing the Srv2.sys file that it can be done by

1. Going to HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManWorkstationParameters2. Creating a DWORD value called 3. Setting its value to 0.”

window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;

try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2020-0796)

The post Microsoft accidentally reveals Wormable Win SMBv3 CVE-2020-0796 Flaw appeared first on Security Affairs.