Overview
On March 11, Beijing time, Microsoft released March 2020 updates to fix vulnerabilities among which is a remote code execution vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3) indicated in a security bulletin released earlier. This vulnerability exists in the way the Microsoft SMBv3 protocol handles certain requests. An attacker could exploit this vulnerability in an unauthenticated way.
For the SMBv3 server, attackers could send a crafted packet to the server to trigger this vulnerability; for the SMBv3 client, attackers could trigger the vulnerability by tricking the user into connecting to a maliciously crafted SMB server.
NSFOCUS has reproduced the vulnerability exploitation process:
Currently, Microsoft has release security updates to fix this vulnerability. As this vulnerability could pose a serious threat, users are strongly advised to apply related protections as soon as possible.
On the night of June 2, a security researcher was reported to announce the PoC code of a remote exploit of this vulnerability, increasing its potential hazard. Users are advised to apply the update as soon as possible to fix this vulnerability:
Reference link:
Affected Versions
- Windows 10 Version 1903 for 32-bit Systems
- Windows 10 Version 1903 for ARM64-based Systems
- Windows 10 Version 1903 for x64-based Systems
- Windows 10 Version 1909 for 32-bit Systems
- Windows 10 Version 1909 for ARM64-based Systems
- Windows 10 Version 1909 for x64-based Systems
- Windows Server, version 1903 (Server Core installation)
- Windows Server, version 1909 (Server Core installation)
Technical Solutions
Official Fix
- Security Patch
Microsoft has released the KB4551762 security update to patch this vulnerability. Users are strongly advised to enable the automatic update service to apply the update for protection.
Microsoft provides security updates for specific Windows versions at the following address:
- Workaround
If users cannot install patches for the time being, they can disable the compression function in SMBv3 for temporary protection of the SMBv3 server:
| Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” DisableCompression -Type DWORD -Value 1 –Force |
Note:
1. No reboot is needed after making the change.
The preceding command is only used to temporarily protect against attacks targeting the SMB server. However, attackers can also exploit this vulnerability to target an SMB client.
2. To protect the SMB client, please read the following article and do as indicated in this article:
3. Disabling SMB compression does not have a negative impact on performance.
For more information, see Microsoft’s official security advisory at the following link:
NSFOCUS’s Recommendations
- Using NSFOCUS’s Detection Products or Services to Detect the Vulnerability
For internal assets, use NSFOCUS Remote Security Assessment System (RSAS V6), Network Intrusion Detection System (NIDS), or Unified Threat Sensor (UTS) to check for the vulnerability:
- RSAS V6
- NIDS
- Upgrade Package/Rule Base Versions of Detection Products
| Detection Product | Upgrade Package/Rule Base Version |
| RSAS V6’s system plug-in | 6.0R02F01.1712 |
| NIDS | 5.6.10.22154, 5.6.9.22154 |
| UTS | 5.6.10.22154 |
- RSAS V6 upgrade package download link
Note: “Microsoft SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) [Thorough Scan]” is a dangerous plug-in which can result in a blue screen of death error on the host or cause the host to restart or shut down. By default, this plug-in is disabled. If this plug-in needs to be enabled, scan it after enabling it.
- NIDS upgrade package download link
5.6.10.22154
5.6.9.22154
- UTS upgrade package download link
- Using NSFOCUS’s Protection Products to Protect Against the Vulnerability
Use NSFOCUS Network Intrusion Protection System (NIPS) to protect against this vulnerability.
- NSFOCUS NIPS
- Upgrade Package/Rule Base Versions of Protection Products
| Protection Product | Upgrade Package/Rule Base Version | Rule ID |
| NIPS | 5.6.10.22154, 5.6.9.22154 | 24763 |
- NIPS upgrade package download link
5.6.10.22154
5.6.9.22154
- Upgrading NSFOCUS’s Security Platforms
| Platform | Upgrade Package/Rule Base Version |
| NSFOCUS Enterprise Security Platform Solution (ESP) | It is unnecessary to upgrade rules on ESPC. If NSFOCUS NIPS is deployed, upgrade it to V5.6.10.22154 or 5.6.9.22154 or later. |
| NSFOCUS Intelligent Security Operation Platform Solution (ISOP) | Install the following rule upgrade package: attack_rule.1.0.0.0.207104.dat |
Technical Analysis
- Vulnerability Principle
The CVE-2020-0796 (aka SMBGhost) vulnerability exists in the data compression function of SMBv3. Microsoft introduces the data compression function in SMBv3 so that users, via prior interactions with an SMBv3 server, can configure to transmit compressed data to the server to increase the transmission efficiency. Through manipulation of certain fields in an SMB packet that contains compressed data, an attacker could trigger an overflow when the decompression program applies for a buffer to store data. As a result, the target system refuses to serve legitimate users due to a blue screen error.
Appendix: Product/Platform Use Guides
- Scanning Configuration on RSAS
- On RSAS, under Services > System Upgrade, click Choose File in the Manual Upgrade area and find the update file just downloaded.
- l Click Upgrade.
- Detection Configuration on UTS
2. On UTS, under System > System Upgrade > Offline Upgrade, browse to the update file just downloaded and click Upload.
- Protection Configuration on NIPS
- On the web-based manager of NSFOCUS NIPS, under System > System Update > Offline Update, browse to the update file just downloaded and click Upload.
- After the update is installed, find the rule ID in the default rule base and view rule details.
- Configuration on ISOP
First, log in to the ISOP platform and click System Upgrade.
On the Unified Rule Base Upgrade page, select Attack Identification Rule Package, import the downloaded latest rule package, and click Upgrade.
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.
NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).
A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.
