Threat Signal Report

(CVE-2020-0796) ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression

Description

Today, Microsoft issued an advisory titled ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression. According to the alert, Microsoft Server Message Block 3.1.1 (SMBv3) suffers from a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client. To exploit the vulnerability, an attacker will have to create a specially crafted packet to a targeted SMBv3 server. To target a SMB client, an attacker will have to create a malicious SMBv3 server and convince a user to connect to it.

What are the specifics of the vulnerability?
Specifics were not disclosed at this time and it appears findings were discovered by Microsoft's Platform Security Assurance and Vulnerability Research team.

Are there reports of active exploitation in the wild?
No.

How serious of an advisory is this?
High. This out of band advisory essentially allows unauthenticated attackers to execute arbritrary code on a remote system. There have been reports that this latest vulnerability is wormable. The last significant wormable threat was the Wannacry ransomware of 2017 which also leveraged a SMB vulnerability from the Shadow Brokers release - for further propagation.

What operating systems are affected?
Windows 10 and Windows Server platforms.

Any suggested mitigations?
The Microsoft Security Advisory ADV200005 suggests the following:

You can disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

Notes:

1. No reboot is needed after making the change.
2. This workaround does not prevent exploitation of SMB clients.

You can disable the workaround with the PowerShell command below.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 0 -Force

It is also advised to place all public facing SMB machines behind a firewall or VPN. It also suggested to block TCP 445 within your firewall at the network perimeter.

What is the status of AV and IPS coverage?
IPS coverage for CVE-2020-0796 was available during the same time of the Microsoft announcement as:
AV coverage is not feasible for this issue.
FortiGuard Labs recommends that all AV and IPS definitions are kept up to date on a continual basis, and that organizations maintain a proactive patching routine when vendor updates are available. If it is deemed that patching is not feasible, it is recommended that a risk assessment is conducted to determine additional mitigation safeguards within an environment.

Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.