Published in News

Vole suffers a bad case of unpatched flaw on its SMB

by on12 March 2020

Despite Microsoft’s time and money it still has more holes than Blackburn

Insecurity experts have found another unpatched vulnerability in version 3.1.1 of the Server Message Block (SMB) -- the service that's used to share files, printers, and other resources on local networks and over the internet.

The flaw means that hackers can craft attacks to execute code of their choice on both servers and end-user computers that use the vulnerable protocol, Microsoft said in an advisory.

The bug, which is tracked as CVE-2020-0796, affects Windows 10, versions 1903 and 1909 and Windows Server versions 1903 and 1909, which are relatively new releases that Microsoft has invested huge amounts of resources hardening against precisely these types of attacks.

Patches aren't available, and Tuesday's advisory gave no timeline for one being released. Asked if there was a timeline for releasing a fix, a Microsoft representative said: "Beyond the advisory you linked, nothing else to share from Microsoft at this time."

Microsoft said vulnerable servers can be protected by disabling compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 server.

Users can use the following PowerShell command to turn off compression without needing to reboot the machine: "Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force." That fix won't protect vulnerable client computers or servers if they connect to a malicious SMB service, but in that scenario, the attacks aren't wormable. Microsoft also recommended users block port 445, which is used to send SMB traffic between machines.

Last modified on 12 March 2020
Rate this item
(0 votes)

Read more about: