Diary

 

Vista/2008/Windows 7 SMB2 BSOD 0Day
Published: 2009-09-08,
Last Updated: 2009-09-09 11:54:16 UTC
by Guy Bruneau (Version: 3)
4 comment(s) Facebookacebook witter

We have received a report from Tyler that a vulnerability affecting Microsoft SMB2 can be remotely crashed with proof-of-concept code that has been published yesterday and a Metasploit module is out.

We have confirmed  it affects Windows 7/Vista/Server 2008. The exploit needs no authentication, only file sharing enabled with one 1 packet to create a BSOD. We recommend filtering access to port TCP 445 with a firewall.

Windows 2000/XP are NOT affected by this exploit.

We will update this diary with more information as we get it.

Update 1: Theodore, an ISC contributor has sent us a couple links on how to disable SMB version 2.0 on Vista or Server 2008. The first post is by Hameed on AskPerf here an the second post is by Daniel Petri here.

Update 2: Microsoft released an new advisory here that shows only the following OS are affected:

  • Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2
  • Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2
  • Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org

Keywords: Windows SMB2
4 comment(s) Facebookacebook witter

Comments

There are indications this might be a Remote Exploit vulnerability and not merely a DOS.
http://www.reversemode.com/index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=64&Itemid=15
posted by gptd, Tue Sep 08 2009, 14:03
I have seen port 445 scanning on average one every three minutes per target IP for a few weeks now. This is much higher than normal for my networks. Chances are this exploit was known before now and is just reaching the kit level. There is much more early distribution of real exploit code going on now than ever before, especially if it does more than a simple DoS.

-Al
posted by Al Thiel of YourDataCenter.com, Tue Sep 08 2009, 15:16
Perhaps, but more likely they're looking for any number of other SMB vulnerabilities that have been disclosed over the past 2 years. SMB has got to be one of the biggest offenders for 0days from Microsoft for a while now. In our enterprise, the top vulns are all SMB or Adobe based.
posted by TheLightCosine, Tue Sep 08 2009, 20:32
According to http://www.microsoft.com/technet/security/advisory/975497.mspx the RTM versions of Windows 7 and Windows Server 2008R2 are not affected.
posted by Freudi, Wed Sep 09 2009, 04:01
you need to log in to comment.
Use your ISC/DShield credentials
E-Mail:
Password:
Diary Archive