Critical unpatched “wormable” remote code execution (RCE) vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3), dubbed EternalDarkness, disclosed by Microsoft.
Background
On March 10, Microsoft published ADV200005, an advisory for a critical RCE vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3). Details about this vulnerability were originally disclosed accidentally in another security vendor’s blog for March’s Microsoft Patch Tuesday. Soon after their blog post was published, the vendor removed reference to the vulnerability, but security researchers already seized on its accidental disclosure.
Microsoft eventually acknowledged the vulnerability publicly and published its advisory for it.
Microsoft is aware of a RCE vulnerability in the way that the SMBv3 protocol handles certain requests. If you wish to be notified when updates for this vulnerability are available, please follow the guidance in the advisory linked here: https://t.co/x5Z658xQ6t
— Security Response (@msftsecresponse) March 10, 2020
Analysis
Microsoft did not assign a CVE identifier for this vulnerability in ADV200005. However, the accidental disclosure of the vulnerability had identified it as CVE-2020-0796.
According to Microsoft, the vulnerability exists in the way the SMBv3 handles certain requests. For SMBv3 Server, an unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to a vulnerable SMBv3 Server. For SMBv3 Client, an attacker would need to convince a user to connect to a malicious SMBv3 Server they’ve configured.
Successful exploitation of the vulnerability would grant the attacker arbitrary code execution in both SMB Server and SMB Client.
Based on an intrusion prevention system (IPS) rule released by FortiGuard Labs, the flaw appears to stem from a buffer overflow vulnerability, which occurs due to an error in the handling of compressed data packets.
Image source: Fortiguard Labs Threat Encyclopedia
This latest vulnerability evokes memories of EternalBlue, most notably CVE-2017-0144, an RCE vulnerability in Microsoft SMBv1 that was used as part of the WannaCry ransomware attacks. It’s certainly an apt comparison, so much so that researchers are referring to it as EternalDarkness. However, there is currently little information available about this new flaw, and the time and effort needed to produce a workable exploit is unknown.
it's okay the official Gossi name is EternalDarkness which doesn't sound super weird at all
— Kevin Beaumont (@GossiTheDog) March 10, 2020
Proof of concept
At the time this blog post was published, there was no proof-of-concept (PoC) available.
Solution
The following versions of Microsoft Windows and Windows Server are affected.
| Product | Version |
|---|---|
| Windows Server | Version 1903 (Server Core Installation) |
| Windows Server | Version 1909 (Server Core Installation) |
| Windows 10 | Version 1903 for 32-bit Systems |
| Windows 10 | Version 1903 for ARM64-based Systems |
| Windows 10 | Version 1903 for x64-based Systems |
| Windows 10 | Version 1909 for 32-bit Systems |
| Windows 10 | Version 1909 for ARM64-based Systems |
| Windows 10 | Version 1909 for x64-based Systems |
There is currently no patch for this vulnerability. However, Microsoft has provided workaround instructions as part of their security advisory. These workaround instructions include a PowerShell command that disables compression for SMBv3 Server to prevent attackers from exploiting the vulnerability.
In addition to disabling compression, Microsoft advises blocking inbound and outbound traffic on TCP port 445 on the perimeter firewall. The Computer Emergency Response Team Coordination Center (CERT/CC) also advises verifying that SMB connections from the internet “are not allowed to connect inbound to an enterprise LAN.”
While these workarounds will prevent exploitation of SMBv3 Server, it is important to note that SMBv3 Client will remain vulnerable until a patch is available and applied.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released. In the interim, customers can utilize the following plugins to build a list of systems that may be affected and require applying the Microsoft recommended mitigations:
Plugin ID 106716: This plugin will report on the SMB Dialects Supported as shown in the output below.
Additionally, you can include plugin ID 11936 in your scan policy to verify the operating system (OS) installed.
Get more information
- ADV200005: Microsoft Security Advisory for SMBv3 Remote Code Execution Flaw
- CERT Coordination Center Vulnerability Note, VU#872016
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.