Windows Server SMB zero-day exploit released after Microsoft failed to issue patch for three months

clock
Windows SMB zero-day exploit released after Microsoft failed to issue patch for three months
Image:

Windows SMB zero-day exploit released after Microsoft failed to issue patch for three months

US CERT recommends blocking all outbound SMB connections until Microsoft (finally) issues patch

An exploit taking advantage of a Microsoft Windows Server zero-day security vulnerability has been released into the wild after the company failed to issue a patch, despite having been warned of the problem three months ago. 

The proof-of-concept exploit, dubbed Win10.py, was released on Github five days ago by security researcher Laurent Gaffie

According to US CERT, the vulnerability is "a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service on a vulnerable system". 

It continues: "Microsoft Windows fails to properly handle traffic from a malicious server. In particular, Windows fails to properly handle a specially-crafted server response that contains too many bytes following the structure defined in the SMB2 TREE_CONNECT Response structure. 

"By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys. We have confirmed the crash with fully-patched Windows 10 and Windows 8.1 client systems, as well as the server equivalents of these platforms, Windows Server 2016 and Windows Server 2012 R2."

US CERT recommends blocking outbound SMB connections - TCP ports 139 and 445 along with UDP ports 137 and 138 - from the local network to the wide area network. 

Despite the publication of the proof-of-concept code last week, Microsoft still hasn't issued a patch, or revealed when a patch will be ready. 

In response to suggestions that it was irresponsible to publicise the security flaw and to publish the exploit, Gaffie suggested that the responsibility lies with Microsoft. "If I'm not rewarded in any way for the free work I'm doing for this multi-billion company, why should I tolerate them sitting on my bugs?" he asked over Twitter. 

More on Cloud and Infrastructure

Breaking news for media's elite: Managed Kubernetes is the next frontier for scaling content providers

Breaking news for media's elite: Managed Kubernetes is the next frontier for scaling content providers

Seva Vayner, director of edge cloud stream at G-Core Labs, on why managed Kubernetes is key for success in the media sector

Seva Vayner
clock 24 May 2022 • 4 min read
Telecoms' profitability problems - and how they might tackle them

Telcos' profitability problems - and how they might tackle them

Telecoms firms should work together on a common technology stack, says a cloud native panel

John Leonard
clock 18 May 2022 • 4 min read
G-Core Labs expands North American presence with a new cloud point of presence in Chicago

G-Core Labs expands North American presence with a new cloud point of presence in Chicago

The new cloud location offers customers in the region both virtual machines and high-performance bare metal servers, integrated with security options including Intel SGX technology, Denial of Service protection and Web Application Firewall.

clock 29 April 2022 • 3 min read