{"id":10219,"date":"2020-03-30T01:37:11","date_gmt":"2020-03-30T01:37:11","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=10219"},"modified":"2026-04-17T18:07:49","modified_gmt":"2026-04-17T18:07:49","slug":"windows-smbv3-remote-code-execution-vulnerability-cve-2020-0796-technical-analysis-and-solution","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/windows-smbv3-remote-code-execution-vulnerability-cve-2020-0796-technical-analysis-and-solution\/","title":{"rendered":"Windows SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) Technical Analysis and Solution"},"content":{"rendered":"


\n<\/p>\n

Overview<\/strong><\/h2>\n

On March 11, Beijing time, Microsoft released March 2020 updates to fix vulnerabilities among which is a remote code execution vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3) indicated in a security bulletin released earlier. This vulnerability exists in the way the Microsoft SMBv3 protocol handles certain requests. An attacker could exploit this vulnerability in an unauthenticated way.<\/p>\n

For the SMBv3 server, attackers could send a crafted packet to the server to trigger this vulnerability; for the SMBv3 client, attackers could trigger the vulnerability by tricking the user into connecting to a maliciously crafted SMB server.<\/p>\n

NSFOCUS has reproduced the vulnerability exploitation process:<\/p>\n

\"Red<\/a><\/p>\n

Currently, Microsoft has release security updates to fix this vulnerability. As this vulnerability could pose a serious threat, users are strongly advised to apply related protections as soon as possible.<\/p>\n

Reference link:<\/p>\n

https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0796<\/strong><\/p>\n

Affected Versions<\/strong><\/h2>\n