On March 11, Beijing time, Microsoft released March 2020 updates to fix vulnerabilities among which is a remote code execution vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3) indicated in a security bulletin released earlier. This vulnerability exists in the way the Microsoft SMBv3 protocol handles certain requests. An attacker could exploit this vulnerability in an unauthenticated way.
For the SMBv3 server, attackers could send a crafted packet to the server to trigger this vulnerability; for the SMBv3 client, attackers could trigger the vulnerability by tricking the user into connecting to a maliciously crafted SMB server.
NSFOCUS has reproduced the vulnerability exploitation process:
Currently, Microsoft has release security updates to fix this vulnerability. As this vulnerability could pose a serious threat, users are strongly advised to apply related protections as soon as possible.
- Windows 10 Version 1903 for 32-bit Systems
- Windows 10 Version 1903 for ARM64-based Systems
- Windows 10 Version 1903 for x64-based Systems
- Windows 10 Version 1909 for 32-bit Systems
- Windows 10 Version 1909 for ARM64-based Systems
- Windows 10 Version 1909 for x64-based Systems
- Windows Server, version 1903 (Server Core installation)
- Windows Server, version 1909 (Server Core installation)
Microsoft has released the KB4551762 security update to patch this vulnerability. Users are strongly advised to enable the automatic update service to apply the update for protection.
Microsoft provides security updates for specific Windows versions at the following address:
If users cannot install patches for the time being, they can disable the compression function in SMBv3 for temporary protection of the SMBv3 server:
|Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” DisableCompression -Type DWORD -Value 1 –Force|
No reboot is needed after making the change.
The preceding command is only used to temporarily protect against attacks targeting the SMB server. However, attackers can also exploit this vulnerability to target an SMB client.
To protect the SMB client, please read the following article and do as indicated in this article:
Disabling SMB compression does not have a negative impact on performance.
For more information, see Microsoft’s official security advisory at the following link:
Using NSFOCUS’s Detection Products or Services to Detect the Vulnerability
For internal assets, use NSFOCUS Remote Security Assessment System (RSAS V6), Network Intrusion Detection System (NIDS), or Unified Threat Sensor (UTS) to check for the vulnerability:
- RSAS V6
- Unified Threat Sensor (UTS)
Upgrade Package/Rule Base Versions of Detection Products
|Detection Product||Upgrade Package/Rule Base Version|
|RSAS V6’s system plug-in||6.0R02F01.1712|
- RSAS V6 upgrade package download link
Note: “Microsoft SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) [Thorough Scan]” is a dangerous plug-in which can result in a blue screen of death error on the host or cause the host to restart or shut down. By default, this plug-in is disabled. If this plug-in needs to be enabled, scan it after enabling it.
- NIDS upgrade package download link
- UTS upgrade package download link
Using NSFOCUS’s Protection Products to Protect Against the Vulnerability
Use NSFOCUS Network Intrusion Protection System (NIPS) to protect against this vulnerability.
- NSFOCUS NIPS
- Upgrade Package/Rule Base Versions of Protection Products
|Protection Product||Upgrade Package/Rule Base Version||Rule ID|
- NIPS upgrade package download link
Upgrading NSFOCUS’s Security Platforms
|Platform||Upgrade Package/Rule Base Version|
|NSFOCUS Enterprise Security Platform Solution (ESP)||It is unnecessary to upgrade rules on ESPC. If NSFOCUS NIPS is deployed, upgrade it to V22.214.171.12454 or 126.96.36.19954 or later.|
|NSFOCUS Intelligent Security Operation Platform Solution (ISOP)||Install the following rule upgrade package:
The CVE-2020-0796 (aka SMBGhost) vulnerability exists in the data compression function of SMBv3. Microsoft introduces the data compression function in SMBv3 so that users, via prior interactions with an SMBv3 server, can configure to transmit compressed data to the server to increase the transmission efficiency. Through manipulation of certain fields in an SMB packet that contains compressed data, an attacker could trigger an overflow when the decompression program applies for a buffer to store data. As a result, the target system refuses to serve legitimate users due to a blue screen error.
Appendix: Product/Platform Use Guides
Scanning Configuration on RSAS
- On RSAS, under Services > System Upgrade, click Choose File in the Manual Upgrade area and find the update file just downloaded.
- Click Upgrade.
- Wait for the installation to complete. Then create a custom scanning template to scan the system for this vulnerability.
Detection Configuration on UTS
On UTS, under System > System Upgrade > Offline Upgrade, browse to the update file just downloaded and click Upload.
Protection Configuration on NIPS
- On the web-based manager of NSFOCUS NIPS, under System > System Update > Offline Update, browse to the update file just downloaded and click Upload.
- After the update is installed, find the rule ID in the default rule base and view rule details.
Note: After the update is installed, the engine automatically restarts to make it take effect, which does not disconnect any sessions, but may cause the loss of three to five packets during ping operations. Therefore, it is recommended that the update be installed at an appropriate time.
Configuration on ISOP
First, log in to the ISOP platform and click System Upgrade.
On the Unified Rule Base Upgrade page, select Attack Identification Rule Package, import the downloaded latest rule package, and click Upgrade.
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.
NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).
A wholly owned subsidiary of NSFOCUS Information Technology Co. Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.