CERT-In Vulnerability Note
CIVN-2009-0141
Microsoft Windows Server Message Block SMB Denial of Service Vulnerability
Original Issue Date:November 16, 2009
Severity Rating: HIGH
Systems Affected
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems
- Windows Server 2008 R2 for Itanium-based Systems
Overview
A zero day vulnerability has been reported in Microsoft Server Message Block SMB implementation. Successful exploitation allows an attacker to cause Denial of service DOS condition in the affected systems. Legitimate users of that system could lose access to system resources until it can be restarted.
Description
Microsoft Server Message Block SMB is a Microsoft network file sharing protocol. The SMBv2 protocol is a major revision of the existing SMB protocol and is only supported on computers running Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. SMBv2 requires both the client and server support which is decided during the negotiation phase. If not, SMB v1 is chosen for subsequent communication.
The vulnerability is due to the Server Message Block SMB protocol software insufficiently validating all fields when parsing specially crafted SMB response packets with NetBIOS header with an incorrect length 4 bytes smaller or more than SMB packet value which leads to an infinite loop condition and kernel crash. An attacker can exploit this vulnerability by tricking a user to visit a website which will force an SMB connection to a malicious SMB server or through compromised Web sites and Web sites that accept or host user-provided content.
Workaround
- Block TCP ports 139, 445 at the firewall
For detailed steps and impact of applying these workarounds refer to Microsoft security Advisory 977544
Solution
Apply appropriate updates as mentioned in Microsoft Security Bulletin
MS10-020
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/advisory/977544.mspx
http://www.microsoft.com/technet/security/Bulletin/MS10-020.mspx
References
Microsoft
http://www.microsoft.com/technet/security/advisory/977544.mspx
http://www.microsoft.com/technet/security/Bulletin/MS10-020.mspx
ISC SANS
http://isc.sans.org/diary.html?storyid=7597
http://isc.sans.org/diary.html?storyid=7573
CISCO Security Intelligence
http://tools.cisco.com/security/center/viewAlert.x?alertId=19422
http://tools.cisco.com/security/center/viewAlert.x?alertId=19173
VUPEN
http://www.vupen.com/english/advisories/2009/3216
Securityfocus
http://www.securityfocus.com/bid/36989
Secunia
http://secunia.com/advisories/37347/
CVE Name
CVE-2009-3676
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|