Threat Update: Microsoft Advises of Wormable SMBv3 Vulnerability

Threat Update: Microsoft Redacts Wormable SMBv3 Vulnerability in Latest Patch Tuesday Release

The information in this advisory is current as of 2:00 PM EST March 11, 2020. Updates may be released as more information becomes available.

Microsoft has released an advisory indicating that there is a critical vulnerability within Server Message Block version 3 (SMBv3), which is the most recent version of the protocol. A flurry of social media chatter, as well as information mistakenly published by multiple reputable security vendors, indicates this may be wormable. Security vendors who posted information regarding the vulnerability have since removed it. At present, no patch exists for this vulnerability. As wild speculation abounds in the security community, this post seeks to clarify the information available at present.

Recommendations

• Ensure that you do not have SMB ports available to the Internet. Consider disabling SMBv3 as well as blocking TCP port 445
• Monitor the Alpha Team Tab and news sources for updates to this vulnerability
• Patch SMBv3 servers immediately when a patch is released

Details

On the morning of Patch Tuesday, March 10, 2020, multiple security vendors released, and then removed, information on a new vulnerability in Microsoft Server Message Block, version 3, or SMBv3. It appears that Microsoft elected to redact this vulnerability with little or no notice prior to Patch Tuesday, as multiple vendors first published, then redacted information on the vulnerability. Although Microsoft redacted the vulnerability from its Patch Tuesday release, Microsoft has since released an advisory. No patch is available at this time, but Microsoft listed a workaround to disable SMBv3 compression. An independent security researcher has released a tool that can be used to determine if you are running a vulnerable version of SMB, which can be found here.

SMB is a protocol used to share resources between Windows machines. Over the last several years, multiple high-profile wormable vulnerabilities have been discovered and exploited, including EternalBlue, in SMBv1 and BlueKeep, in RDP or Remote Desktop Protocol. In particular, EternalBlue was heavily utilized by attackers in ransomware attacks, including WannaCry and NotPetya, which occurred in early summer 2018. Although the cost of these attacks was great - it has been estimated that WannaCry cost affected organizations nearly $4 billion - it is important to note that they could have been much worse. The malware leveraged in the WannaCry attacks, in particular, included a built-in kill switch that allowed a researcher to shut down the malware’s spread. It is highly unlikely future malware will include a kill switch of this sort.

The description intended to accompany this CVE’s announcement, as mistakenly released by multiple security vendors, indicates that this vulnerability is wormable. This would allow attackers exploiting this vulnerability to move between machines easily, with no user interaction. A full description of the vulnerability, posted on Twitter by a researcher who caught the post before its removal, can be seen below.

Figure 1. Post from a security vendor containing details regarding a potential wormable SMBv3 vuln.

ZeroFOX Alpha Team is actively monitoring this situation as new details develop. ZeroFOX recommends enacting the recommendations above as a precaution until further information is made available.