Windows SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) Technical Analysis and Solution

Windows SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) Technical Analysis and Solution

June 15, 2020 | Mina Hao

Overview

On March 11, Beijing time, Microsoft released March 2020 updates to fix vulnerabilities among which is a remote code execution vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3) indicated in a security bulletin released earlier. This vulnerability exists in the way the Microsoft SMBv3 protocol handles certain requests. An attacker could exploit this vulnerability in an unauthenticated way.

For the SMBv3 server, attackers could send a crafted packet to the server to trigger this vulnerability; for the SMBv3 client, attackers could trigger the vulnerability by tricking the user into connecting to a maliciously crafted SMB server.

NSFOCUS has reproduced the vulnerability exploitation process:

Currently, Microsoft has release security updates to fix this vulnerability. As this vulnerability could pose a serious threat, users are strongly advised to apply related protections as soon as possible.

On the night of June 2, a security researcher was reported to announce the PoC code of a remote exploit of this vulnerability, increasing its potential hazard. Users are advised to apply the update as soon as possible to fix this vulnerability:

Reference link:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796

Affected Versions

  • Windows 10 Version 1903 for 32-bit Systems
  • Windows 10 Version 1903 for ARM64-based Systems
  • Windows 10 Version 1903 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows Server, version 1903 (Server Core installation)
  • Windows Server, version 1909 (Server Core installation)

Technical Solutions

Official Fix

  • Security Patch

Microsoft has released the KB4551762 security update to patch this vulnerability. Users are strongly advised to enable the automatic update service to apply the update for protection.

Microsoft provides security updates for specific Windows versions at the following address:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4551762
  • Workaround

If users cannot install patches for the time being, they can disable the compression function in SMBv3 for temporary protection of the SMBv3 server:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” DisableCompression -Type DWORD -Value 1 –Force

Note:

1. No reboot is needed after making the change.

The preceding command is only used to temporarily protect against attacks targeting the SMB server. However, attackers can also exploit this vulnerability to target an SMB client.

2. To protect the SMB client, please read the following article and do as indicated in this article:

https://support.microsoft.com/en-us/help/3185535/preventing-smb-traffic-from-lateral-connections

3. Disabling SMB compression does not have a negative impact on performance.

For more information, see Microsoft’s official security advisory at the following link:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796

NSFOCUS’s Recommendations

  • Using NSFOCUS’s Detection Products or Services to Detect the Vulnerability

For internal assets, use NSFOCUS Remote Security Assessment System (RSAS V6), Network Intrusion Detection System (NIDS), or Unified Threat Sensor (UTS) to check for the vulnerability:

  • RSAS V6
http://update.nsfocus.com/update/listRsas
  • NIDS
http://update.nsfocus.com/update/listIds
http://update.nsfocus.com/update/bsaUtsIndex
  • Upgrade Package/Rule Base Versions of Detection Products
Detection ProductUpgrade Package/Rule Base Version
RSAS V6’s system plug-in6.0R02F01.1712
NIDS5.6.10.22154, 5.6.9.22154
UTS5.6.10.22154
  • RSAS V6 upgrade package download link
http://update.nsfocus.com/update/downloads/id/103169

Note: “Microsoft SMBv3 Remote Code Execution Vulnerability (CVE-2020-0796) [Thorough Scan]” is a dangerous plug-in which can result in a blue screen of death error on the host or cause the host to restart or shut down. By default, this plug-in is disabled. If this plug-in needs to be enabled, scan it after enabling it.

  • NIDS upgrade package download link

5.6.10.22154

http://update.nsfocus.com/update/downloads/id/103168

5.6.9.22154

http://update.nsfocus.com/update/downloads/id/103167
  • UTS upgrade package download link
http://update.nsfocus.com/update/downloads/id/103172
  • Using NSFOCUS’s Protection Products to Protect Against the Vulnerability

Use NSFOCUS Network Intrusion Protection System (NIPS) to protect against this vulnerability.

  • NSFOCUS NIPS
http://update.nsfocus.com/update/listIps
  • Upgrade Package/Rule Base Versions of Protection Products
Protection ProductUpgrade Package/Rule Base VersionRule ID
NIPS5.6.10.22154, 5.6.9.2215424763
  • NIPS upgrade package download link

5.6.10.22154

http://update.nsfocus.com/update/downloads/id/103168

5.6.9.22154

http://update.nsfocus.com/update/downloads/id/103167
  • Upgrading NSFOCUS’s Security Platforms
PlatformUpgrade Package/Rule Base Version
NSFOCUS Enterprise Security Platform Solution (ESP)It is unnecessary to upgrade rules on ESPC. If NSFOCUS NIPS is deployed, upgrade it to V5.6.10.22154 or 5.6.9.22154 or later.
NSFOCUS Intelligent Security Operation Platform Solution (ISOP)Install the following rule upgrade package: attack_rule.1.0.0.0.207104.dat

Technical Analysis

  • Vulnerability Principle

The CVE-2020-0796 (aka SMBGhost) vulnerability exists in the data compression function of SMBv3. Microsoft introduces the data compression function in SMBv3 so that users, via prior interactions with an SMBv3 server, can configure to transmit compressed data to the server to increase the transmission efficiency. Through manipulation of certain fields in an SMB packet that contains compressed data, an attacker could trigger an overflow when the decompression program applies for a buffer to store data. As a result, the target system refuses to serve legitimate users due to a blue screen error.

Appendix: Product/Platform Use Guides

  • Scanning Configuration on RSAS
  • On RSAS, under Services > System Upgrade, click Choose File in the Manual Upgrade area and find the update file just downloaded.
  • l  Click Upgrade.
  • Detection Configuration on UTS

2. On UTS, under System > System Upgrade > Offline Upgrade, browse to the update file just downloaded and click Upload.

  • Protection Configuration on NIPS
  • On the web-based manager of NSFOCUS NIPS, under System > System Update > Offline Update, browse to the update file just downloaded and click Upload.
  • After the update is installed, find the rule ID in the default rule base and view rule details.
    • Configuration on ISOP

First, log in to the ISOP platform and click System Upgrade.

On the Unified Rule Base Upgrade page, select Attack Identification Rule Package, import the downloaded latest rule package, and click Upgrade.

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.