Windows SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) Technical Analysis and Solution

Overview

On March 11, Beijing time, Microsoft released March 2020 updates to fix vulnerabilities among which is a remote code execution vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3) indicated in a security bulletin released earlier. This vulnerability exists in the way the Microsoft SMBv3 protocol handles certain requests. An attacker could exploit this vulnerability in an unauthenticated way.

For the SMBv3 server, attackers could send a crafted packet to the server to trigger this vulnerability; for the SMBv3 client, attackers could trigger the vulnerability by tricking the user into connecting to a maliciously crafted SMB server.

NSFOCUS has reproduced the vulnerability exploitation process:

Currently, Microsoft has release security updates to fix this vulnerability. As this vulnerability could pose a serious threat, users are strongly advised to apply related protections as soon as possible.

Reference link:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796

Affected Versions

• Windows 10 Version 1903 for 32-bit Systems
• Windows 10 Version 1903 for ARM64-based Systems
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows Server, version 1903 (Server Core installation)
• Windows Server, version 1909 (Server Core installation)

Technical Solutions

• Official Fix

Security Patch

Microsoft has released the KB4551762 security update to patch this vulnerability. Users are strongly advised to enable the automatic update service to apply the update for protection.

Microsoft provides security updates for specific Windows versions at the following address:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4551762

Workaround

If users cannot install patches for the time being, they can disable the compression function in SMBv3 for temporary protection of the SMBv3 server:

Note:

No reboot is needed after making the change.

The preceding command is only used to temporarily protect against attacks targeting the SMB server. However, attackers can also exploit this vulnerability to target an SMB client.

To protect the SMB client, please read the following article and do as indicated in this article:

https://support.microsoft.com/en-us/help/3185535/preventing-smb-traffic-from-lateral-connections

Disabling SMB compression does not have a negative impact on performance.

For more information, see Microsoft’s official security advisory at the following link:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796

NSFOCUS’s Recommendations

Using NSFOCUS’s Detection Products or Services to Detect the Vulnerability

For internal assets, use NSFOCUS Remote Security Assessment System (RSAS V6), Network Intrusion Detection System (NIDS), or Unified Threat Sensor (UTS) to check for the vulnerability:

• RSAS V6

http://update.nsfocus.com/update/listRsas

• NIDS

http://update.nsfocus.com/update/listIds

• Unified Threat Sensor (UTS)

http://update.nsfocus.com/update/bsaUtsIndex

Upgrade Package/Rule Base Versions of Detection Products

• RSAS V6 upgrade package download link

http://update.nsfocus.com/update/downloads/id/103169

Note: “Microsoft SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) [Thorough Scan]” is a dangerous plug-in which can result in a blue screen of death error on the host or cause the host to restart or shut down. By default, this plug-in is disabled. If this plug-in needs to be enabled, scan it after enabling it.

• NIDS upgrade package download link

5.6.10.22154

http://update.nsfocus.com/update/downloads/id/103168

5.6.9.22154

http://update.nsfocus.com/update/downloads/id/103167

• UTS upgrade package download link

http://update.nsfocus.com/update/downloads/id/103172

Using NSFOCUS’s Protection Products to Protect Against the Vulnerability

Use NSFOCUS Network Intrusion Protection System (NIPS) to protect against this vulnerability.

• NSFOCUS NIPS

http://update.nsfocus.com/update/listIps

• Upgrade Package/Rule Base Versions of Protection Products

• NIPS upgrade package download link

5.6.10.22154

http://update.nsfocus.com/update/downloads/id/103168

5.6.9.22154

http://update.nsfocus.com/update/downloads/id/103167

Upgrading NSFOCUS’s Security Platforms

Technical Analysis

Vulnerability Principle

The CVE-2020-0796 (aka SMBGhost) vulnerability exists in the data compression function of SMBv3. Microsoft introduces the data compression function in SMBv3 so that users, via prior interactions with an SMBv3 server, can configure to transmit compressed data to the server to increase the transmission efficiency. Through manipulation of certain fields in an SMB packet that contains compressed data, an attacker could trigger an overflow when the decompression program applies for a buffer to store data. As a result, the target system refuses to serve legitimate users due to a blue screen error.

Appendix: Product/Platform Use Guides

Scanning Configuration on RSAS

1. On RSAS, under Services > System Upgrade, click Choose File in the Manual Upgrade area and find the update file just downloaded.
2. Click Upgrade.
3. Wait for the installation to complete. Then create a custom scanning template to scan the system for this vulnerability.

Detection Configuration on UTS

On UTS, under System > System Upgrade > Offline Upgrade, browse to the update file just downloaded and click Upload.

Protection Configuration on NIPS

1. On the web-based manager of NSFOCUS NIPS, under System > System Update > Offline Update, browse to the update file just downloaded and click Upload.
2. After the update is installed, find the rule ID in the default rule base and view rule details.

Note: After the update is installed, the engine automatically restarts to make it take effect, which does not disconnect any sessions, but may cause the loss of three to five packets during ping operations. Therefore, it is recommended that the update be installed at an appropriate time.

Configuration on ISOP

First, log in to the ISOP platform and click System Upgrade.

On the Unified Rule Base Upgrade page, select Attack Identification Rule Package, import the downloaded latest rule package, and click Upgrade.

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Information Technology Co. Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.