Details about new SMB wormable bug leak in Microsoft Patch Tuesday snafu

By -

 SMB vulnerability is currently not patched, but now everyone knows it's there.

Details about a new "wormable" vulnerability in the Microsoft Server Message Block (SMB) protocol have accidentally leaked online today during the preamble to Microsoft's regular Patch Tuesday update cycle.


No technical details have been published, but short summaries describing the bug have been posted on the websites of two cyber-security firms, Cisco Talos and Fortinet.

The security flaw, tracked as CVE-2020-0796, is not included with this month's March 2020 Patch Tuesday updates, and it's unclear when it will be patched.

BUFFER OVERFLOW IN SMBV3

According to Fortinet, the bug was described as "a Buffer Overflow Vulnerability in Microsoft SMB Servers" and received a maximum severity rating.

"The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet," Fortinet said. "A remote, unauthenticated attacker can exploit this to execute arbitrary code within the context of the application."

A similar description was also posted -- and later removed -- in a Cisco Talos blog post. The company said that "the exploitation of this vulnerability opens systems up to a 'wormable' attack, which means it would be easy to move from victim to victim."

Warning of a wormable bug impacting SMB stands to send chills down some system administrators' backs. This is because SMB is the same protocol that helped the WannaCry and NotPetya ransomware strains spread globally through a worm-like behavior during the spring and summer of 2017.

NO ATTACKS EXPECTED RIGHT NOW

However, there is currently no danger to organizations worldwide. Only details about the bug leaked online, not actual exploit code, as it did in 2017.

Although today's leak alerted some bad actors about a major bug's presence in SMBv3, exploitation attempts aren't expected to start anytime soon.

Furthermore, there are also other positives. For example, this new "wormable SMB bug" only impacts SMBv3, the latest version of the protocol, included only with recent versions of Windows.

More specifically, Fortinet only lists Windows 10 v1903, Windows10 v1909, Windows Server v1903, and Windows Server v1909 as impacted by the new CVE-2020-0796 bug.

UNCLEAR HOW THE LEAK HAPPENED

How and why the details about such a critical vulnerability leaked online remains a mystery, at least for now. Microsoft did not return a request for comment before this article's publication.

There are currently two theories about how this might have happened. The first involves the Common Vulnerability Reporting Framework (CVRF) and the Microsoft Active Protections Program (MAPP).

This refers to Microsoft sharing details about upcoming patches with trusted industry partners, such as antivirus makers and hardware vendors.

The theory is that Microsoft might have shared a list of upcoming vulnerabilities, but then removed the bug from the list with little time for some vendors -- like Cisco Talos and Fortinet -- to update their own security advisories.

The second is that the info about CVE-2020-0796 was accidentally shared via the Microsoft API, which some antivirus vendors, sysadmins, and reporters scrape for information about Patch Tuesday patches, as soon as they come out.

The theory is that the bug might have been initially scheduled to receive a patch this month, but was later pulled; however, without being removed from the API, and eventually making its way into the Talos and Fortinet advisories.

Microsoft did not return a request for comment about when a patch will be delivered for CVE-2020-0796.

Until then, Cisco Talos' now-deleted advice remains the most reliable advice on dealing with any unexpected situations in relation to this bug.

"Users are encouraged to disable SMBv3 compression and block TCP port 445 on firewalls and client computers."

In light of the patching snafu, some security researchers have now started calling the bug SMBGhost, as everyone knows the bug is there, but nobody can see it.

Comments

Post a Comment

Popular Posts

Hacker steals data of millions of Bulgarians, emails it to local media

By -
Image
  Source of the data breach appears to be the country's National Revenue Agency A mysterious hacker has stolen the personal details of millions of Bulgarians and has emailed download links to the stolen data to local news publications. The data's origin is believed to be the country's National Revenue Agency (NRA), a department of the Bulgarian Ministry of Finance. In a  message posted on its website  on Monday, the NRA said it was working with the Ministry of the Interior and the State Agency for National Security (SANS) to investigate the hack. "We are currently verifying whether the data is real," said the NRA. Hours after this article's publication, the Bulgarian Ministry of the Interior  confirmed the hack . HACKER STOLE 110 DATABASES, LEAKED 57 According to reports from local media [ 1 ,  2 ,  3 ,  4 ,  5 ], who received part of the data, the hacker said they stole the personal details of over five million Bulgarians, of the country's total ...
Read more

​Linux totally dominates supercomputers

By -
Image
It finally happened. Today, all 500 of the world's top 500 supercomputers are running Linux. Linux rules supercomputing. This day has been coming since 1998, when Linux first appeared on the TOP500 Supercomputer list . Today it finally happened:  All 500 of the world's fastest supercomputers are running Linux . The last two non-Linux systems, a pair of Chinese IBM POWER computers running AIX, dropped off the  November 2017 TOP500 Supercomputer list . Overall, China now leads the supercomputing race with 202 computers to the US' 144. China also leads the US in aggregate performance. China's supercomputers represent 35.4 percent of the Top500's flops, while the US trails with 29.6 percent. With an anti-science regime in charge of the government, America will only continue to see its technological lead decline. When the  first Top500 supercomputer list was compiled in June 1993 , Linux was barely more than a toy. It hadn't even adopted Tux as its masc...
Read more

Microsoft tries to stem its self-made collaboration-tool confusion

By -
Image
Microsoft is using this week's Ignite conference to try to help clarify its collaboration-tool strategy. Here's how SharePoint, Teams and Yammer figure in the mix. Choice is good. But too much choice, especially when it comes to collaboration tools, has been a problem for Microsoft. This isn't news to customers, partners or Microsoft execs themselves. But at the company's Ignite IT Pro conference in Orlando this week, Microsoft execs took a step to try to clarify the company's strategy and messaging in this area. Microsoft Office 365 Marketing chief Ron Markezich kicked off the conference this week with a slide entitled "Microsoft 365 Teamwork: Where to Start a Conversation." That slide attempts to do what  Microsoft initially attempted with a 60-plus-page whitepaper : Clarify which collaboration tools customers should use when. The slide, which features SharePoint -- and its files, sites and content storage at the center -- is broken down into t...
Read more