Threat Brief: Microsoft SMBv3 Wormable Vulnerability CVE-2020-0796
Summary: In March 2020 Microsoft issued advisory ADV200005 for a remote code execution vulnerability in SMBv3, tracked as CVE-2020-0796, and followed it with an out-of-band patch released two days after Patch Tuesday. The flaw involves malformed compression headers, a feature added to SMBv3 negotiate context request packets in May 2019, and unauthenticated exploitation requires sending a crafted SMBv3 packet to a vulnerable server, while client-side exploitation requires enticing a user to connect to an attacker-controlled SMBv3 server.
What's compelling: Microsoft said at release it had not seen the vulnerability exploited in the wild, but a wormable unauthenticated RCE in SMBv3 means an unpatched server is reachable by anyone who can send it a single crafted packet.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-0796
- Related
- CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022Microsoft Patch Tuesday, April 2020 Edition Cyber Risks ·