• Home
  • News
  • Big Data & Analytics
  • DevOps
  • Security
  • GDPR
  • AI & ML
  • Women in Tech
  • Cloud & Infrastructure
  • CIO
  • Deskflix
  • Events
  • Whitepapers
  • Spotlights
  • IT Leaders 250
  • Research
  • Delta
  • Tech Marketing Hub
  • About Us
  • Newsletters
  • Sign in
  •  
      • Newsletters
      • Account details
      • Contact support
      • Sign out
     
     
    • You are currently accessing Computing via your Enterprise account.

      If you already have an account please use the link below to sign in.

      If you have any problems with your access or would like to request an individual access account please contact our customer service team.

      Phone: +44 (0) 1858 438800

      Email: customerservices@incisivemedia.com

      • Sign in
     
  • Follow us
    • Twitter
    • LinkedIn
    • Newsletters
    • Facebook
    • YouTube
  • Register
  • Events
    • Upcoming events
      event logo
      The Pesky Password Problem: What place do passwords have in the modern workplace?

      In this webinar you'll learn: Why passwords are so easy to hack, and how the bad guys do it. How to craft a secure, risk-focused password security policy. The truth about password managers and multi-factor authentication and how they impact our risk. How to empower your end users to become your best last line of defence

      • Date: 21 Jan 2021
      event logo
      Where the buck stops: Why a shared responsibility model will help you own your cloud security flaws

      This webinar, and accompanying dedicated research, will reveal to what extent organisations are practicing a shared responsibility model for cloud security today and the degree to which IT leaders are aware of what they should be doing to ensure the secure use of their multi- and hybrid-cloud environments.

      • Date: 27 Jan 2021
      event logo
      Leveraging the Cloud to Defeat Data Disasters

      Join us and learn how your IT team can realize many of the powerful advantages of the cloud and solve the operational complexity behind managing data across hybrid and multi-cloud IT environments with centralized management, automation, end-to-end security, and lower TCO.

      • Date: 28 Jan 2021
      event logo
      Deskflix Hybrid and Multi Cloud

      One of the most powerful tools for breaking down silos and integrating resources is cloud computing. But multi-tenancy cloud is not the ideal environment for every application or every class of data and some will need to remain on-prem for the foreseeable future; nor are all clouds equal. Tune in to Deskflix season 1 to hear industry experts speak on the questions you need answered on hybrid and multi cloud.

      • Date: 10 Feb 2021
      View all events
  • Whitepapers
    • LATEST WHITEPAPERS
      Darktrace 120x194
      Cyber AI Response: Threat Report 2019

      This white paper details 7 case studies of attacks that were intercepted and neutralised by Darktrace cyber defense AI, including a zero-day trojan in a manufacturing company's network. Learn how Darktrace Antigena AI Response modules fight back autonomously, no matter where a threat may emerge, extending to the Cloud, Email and SaaS.

      Download
      Darktrace 120x194
      Cyber AI & Darktrace Cloud

      This white paper explores how cloud is a security blind spot for many organisations who struggle with the limited visibility and control in this new environment, where their existing security tools are often not applicable.

      Download
      Find whitepapers
      Search by title or subject area
      View all whitepapers
  • Spotlights
    • Spotlights

      Welcome to Computing's Spotlight section, where we focus in on particularly important themes and topics of enterprise IT.

      Intel logo

       

      Endpoint Management and Security Hub

  • IT Leaders 250
  • Research
  • Delta
  • Tech Marketing Hub
  • About Us
Computing
Computing
  • Home
  • News
  • Big Data & Analytics
  • DevOps
  • Security
  • GDPR
  • AI & ML
  • Women in Tech
  • Cloud & Infrastructure
  • CIO
  • Deskflix
 
    • Newsletters
    • Account details
    • Contact support
    • Sign out
 
 
  • You are currently accessing Computing via your Enterprise account.

    If you already have an account please use the link below to sign in.

    If you have any problems with your access or would like to request an individual access account please contact our customer service team.

    Phone: +44 (0) 1858 438800

    Email: customerservices@incisivemedia.com

    • Sign in
 
  • Security

Windows Server SMB zero-day exploit released after Microsoft failed to issue patch for three months

US CERT recommends blocking all outbound SMB connections until Microsoft (finally) issues patch

Windows SMB zero-day exploit released after Microsoft failed to issue patch for three months
Windows SMB zero-day exploit released after Microsoft failed to issue patch for three months
  • Graeme Burton
  • @graemeburton
  • 06 February 2017
  • Tweet  
  • Facebook  
  • LinkedIn  
  • Send to  
0 Comments

An exploit taking advantage of a Microsoft Windows Server zero-day security vulnerability has been released into the wild after the company failed to issue a patch, despite having been warned of the problem three months ago. 

The proof-of-concept exploit, dubbed Win10.py, was released on Github five days ago by security researcher Laurent Gaffie. 

According to US CERT, the vulnerability is "a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service on a vulnerable system". 

It continues: "Microsoft Windows fails to properly handle traffic from a malicious server. In particular, Windows fails to properly handle a specially-crafted server response that contains too many bytes following the structure defined in the SMB2 TREE_CONNECT Response structure. 

"By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys. We have confirmed the crash with fully-patched Windows 10 and Windows 8.1 client systems, as well as the server equivalents of these platforms, Windows Server 2016 and Windows Server 2012 R2."

US CERT recommends blocking outbound SMB connections - TCP ports 139 and 445 along with UDP ports 137 and 138 - from the local network to the wide area network. 

Despite the publication of the proof-of-concept code last week, Microsoft still hasn't issued a patch, or revealed when a patch will be ready. 

In response to suggestions that it was irresponsible to publicise the security flaw and to publish the exploit, Gaffie suggested that the responsibility lies with Microsoft. "If I'm not rewarded in any way for the free work I'm doing for this multi-billion company, why should I tolerate them sitting on my bugs?" he asked over Twitter. 

If i'm not rewarded in any way for the free work I'm doing for this multi-billion company, why should I tolerate them sitting on my bugs?— Responder (@PythonResponder)February 1, 2017

Further reading

'Dirty COW' Linux kernel security vulnerability being exploited in the wild, warns Red Hat
  • Open Source
  • 21 October 2016
Russian 'Fancy Bear' hackers accused of exploiting Windows flaw exposed by Google
  • Security
  • 02 November 2016
AWS presents: Another crass PR stunt exploiting the vulnerable and forgotten to sell cloud services
  • Leadership
  • 12 January 2017
Microsoft Patch Tuesday to fix flaw exploited in ransomware malvertising campaign
  • Security
  • 12 October 2016
118 out of 121 Oracle E-Business suite vulnerabilities "remotely exploitable"
  • Security
  • 18 January 2017
77 per cent of UK enterprise has adopted videoconferencing and collaboration in last three years
  • Communications
  • 06 February 2017
  • Tweet  
  • Facebook  
  • LinkedIn  
  • Send to  
  • Topics
  • Security
  • Cloud and Infrastructure
  • Hacking
  • Threats and Risks
  • Security
  • zero-day
  • Windows Server
  • vulnerability
  • Laurent Gaffie
  • Microsoft
  • Github
  • SMB Spotlight
  • smb-networking
  • smb-server
  • smb-services
  • smb-storage
  • security-spotlight

More on Security

Taking advantage of the crisis: let's talk about modernising IT

Now we’ve all seen the cloud advantage, it’s time to deal with that legacy tech says Dave Chapman of Cloudreach

  • Cloud and Infrastructure
  • 21 January 2021
Signal, Facebook and Google among apps open to eavesdropping
Signal, Facebook and Google among apps open to eavesdropping

The bugs could allow criminals to listen in on private calls without the target's knowledge

  • Threats and Risks
  • 21 January 2021
New SolarWinds hack victims emerging every day, as Malwarebytes goes public on breach
New SolarWinds hack victims emerging every day, as Malwarebytes goes public on breach

No quick fix to massive hack say security experts as a fourth malware strain is discovered

  • Security
  • 20 January 2021
Trump mandates closer cooperation between government and cloud providers to fight criminals
Trump mandates closer cooperation between government and cloud providers to fight criminals

The twice-impeached President's latest executive order requires cloud providers like AWS, Microsoft and Google to maintain records on overseas customers

  • Cloud and Infrastructure
  • 20 January 2021
Cybersecurity in 2021: Looking ahead to another unpredictable year
Cybersecurity in 2021: Looking ahead to another unpredictable year

The big topics will be the cloud, social engineering, automation and security budgets, as firms work to address corners cut in the pandemic

  • Security
  • 19 January 2021
blog comments powered by Disqus
Back to Top

Most read

Software errors wipes 'thousands' of arrest records from police databases
Software errors wipes 'thousands' of arrest records from police databases
New SolarWinds hack victims emerging every day, as Malwarebytes goes public on breach
New SolarWinds hack victims emerging every day, as Malwarebytes goes public on breach
Women in IT: don't get stuck in 'glue work' if you want to get on
Women in IT: don't get stuck in 'glue work' if you want to get on
BT faces possible £500m claim for overcharging landline-only customers
BT faces possible £500m claim for overcharging landline-only customers
Hackers 'manipulated' stolen documents to undermine trust in coronavirus vaccines
Hackers 'manipulated' stolen documents to undermine trust in coronavirus vaccines
  • Contact
  • Delta
  • Marketing solutions
  • Enterprise IT Events
  • Incisive Media
  • Terms & conditions
  • Policies
  • Careers
  • Twitter
  • LinkedIn
  • Newsletters
  • Facebook
  • YouTube

im_logo

© Incisive Business Media (IP) Limited, Published by Incisive Business Media Limited, New London House, 172 Drury Lane, London WC2B 5QR, registered in England and Wales with company registration numbers 09177174 & 09178013

Digital publisher of the year
Digital publisher of the year 2010, 2013, 2016 & 2017
Loading