CVE-2020-0796 | Server Message Block 3.0 (SMBv3) Remote Code Execution

Published: 2020-03-10
MITRE CVE-2020-0796

As of writing, Microsoft has not released any official information, but FortiGuard writes that there exists a “(…) Buffer Overflow Vulnerability in Microsoft SMB Servers. The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet. A remote, unauthenticated attacker can exploit this to execute arbitrary code within the context of the application.”

And as affected products FortiGuard mentions Windows 10, and Semi-Annual Channel (Windows Server 1903 and 1909). But as Microsoft has not released any official information this might be subject to change.

Basefarm does not recommend anyone to expose SMB and port 445 to an untrusted network. There also exists unofficial mitigation by adding a registry key to disable compression on the SMBv3 protocol. Basefarm is following the developments here, but as of writing there is no known proof of exploit or exploitation in the wild, there is also no official fix for this vulnerability.

Update 2020-03-11:

Microsoft has now released an advisory where they confirm previously known details and adds “to exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.”

So this vulnerability is more of a client-issue than a server issue. The known workaround to disable compression in SMBv3 prevents exploitation against an SMB Server, not an SMB Client.

Still no official fix, no known exploitation in the wild and no proof of concept available.

Basefarm is tracking this is a client issue in BF-VLN-2003557 and will most likely force all our clients to install this as soon as an official fix is available. We recommend others do too.