Sign up to our newsletter
The latest security news direct to your inbox
Some traffic has crossed my radar concerning a 0-day exploit that apparently enables a remote attacker to crash a Vista or Windows 7 system with SMB enabled (and according to subsequent reports, Server 2008). The original post and exploit are claimed to demonstrate the possibility of a Blue Screen Of Death (BSOD) and (normally) an automatic reboot when the SMB2 driver fails to handle malformed headers correctly.
However, subsequent traffic on a specialist mailing list indicates that the underlying vulnerability could also be used to effect remote code execution and local privilege escalation. SecurityFocus has subsequently reported this as a remote code execution vulnerability, and cites a CVE reference CVE-2009-3103, but this isn’t listed at CVE (Common Vulnerabilities and Exploits) at time of writing.
According to the Internet Storm Center, a Microsoft advisory has become available: "Microsoft Security Advisory (975497) Vulnerabilities in SMB Could Allow Remote Code Execution", at www.microsoft.com/technet/security/advisory/975497.mspx: however, I’m just getting an error message on that URL right now. This vulnerability is not addressed by this month’s "Patch Tuesday" updates.
A preliminary analysis from the University of Minnesota passed onto a specialist list suggests that the exploit defaults to 445/tcp, and suggests some possible mitigations:
Brian Eckman, the analyst in question, notes that "..the steps taken for servers require a registry change and a reboot, while disabling the SMB2 client appears to only require a couple commands to be run." So administrators on large sites will need to warn end users and departments before applying mitigation on such machines.
Hopefully, the promised Microsoft advisory will become available shortly: I would expect this to include precise information on short-term workarounds.
David Harley BA CISSP FBCS CITP
Director of Malware Intelligence
ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch
ESET White Papers Page: http://www.eset.com/download/whitepapers.php
Author David Harley, ESET