Windows Exploit Now In The Wild…. Sysadmins Should Worry
There’s a new Windows exploit that is now in the wild. What’s scary about it is that Microsoft has not fixed this exploit and there is a proof of concept attack that is now available for it. Here is what CERT had to say:
Microsoft Windows fails to properly handle traffic from a malicious server. In particular, Windows fails to properly handle a specially-crafted server response that contains too many bytes following the structure defined in the SMB2 TREE_CONNECT Response structure. By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys. We have confirmed the crash with fully-patched Windows 10 and Windows 8.1 client systems, as well as the server equivalents of these platforms, Windows Server 2016 and Windows Server 2012 R2.
Note that there are a number of techniques that can be used to trigger a Windows system to connect to an SMB share. Some may require little to no user interaction.
Exploit code for this vulnerability is publicly available.
Let me translate for you. If you have a Windows Server in your environment that serves stuff up to Windows clients (or anything else for that matter such as Macs), it is using the SMB protocol. There’s a bug in the SMB protocol that allows someone with the right skills to perform a denial of service attack on the server by crashing it. Now this is only an issue if you let SMB traffic go from the server or servers in question to the broader Internet. While that’s something that I do not recommend, a lot of companies and individuals with home Network Attached Storage boxes do that. Seeing as there’s no patch at present, blocking outbound SMB traffic is the best way to protect yourself.
Now Microsoft was apparently told about this issue three months ago by security researcher Laurent Gaffie. But they didn’t come up with a fix, thus he went the route of releasing POC attack code on Github. Thus now that it’s in the wild, it will be interesting how fast the folks in Redmond come up with a fix.
February 22, 2017 at 11:13 am
[…] systems. Specifically this one that I highlighted here last week. But the weird part is that an exploit that is in the wild that I spoke about recently is left unpatched. Seeing as that exploit is the more serious of the two, you’d think that […]