====================================================================

                                 CERT-Renater

                    Note d'Information No. 2017/VULN028
_____________________________________________________________________

DATE                : 03/02/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Microsoft Windows.

=====================================================================
http://www.kb.cert.org/vuls/id/867968
____________________________________________________________________

Vulnerability Note VU#867968

Microsoft Windows SMB Tree Connect Response memory corruption
vulnerability


Original Release date: 02 Feb 2017 | Last revised: 02 Feb 2017


Overview

Microsoft Windows contains a memory corruption bug in the handling of
SMB traffic, which may allow a remote, unauthenticated attacker to
cause a denial of service or potentially execute arbitrary code on a
vulnerable system.


Description

Microsoft Windows fails to properly handle traffic from a malicious
server. In particular, Windows fails to properly handle a server
response that contains too many bytes following the structure defined
in the SMB2 TREE_CONNECT Response structure. By connecting to a
malicious SMB server, a vulnerable Windows client system may crash
(BSOD) in mrxsmb20.sys. It is not clear at this point whether this
vulnerability may be exploitable beyond a denial-of-service attack. We
have confirmed the crash with fully-patched Windows 10 and Windows 8.1
client systems.

Note that there are a number of techniques that can be used to trigger
a Windows system to connect to an SMB share. Some may require little to
no user interaction.

Exploit code for this vulnerability is publicly available.


Impact

By causing a Windows system to connect to a malicious SMB share, a
remote attacker may be able to cause a denial of service or potentially
execute arbitrary code with Windows kernel privileges.


Solution

The CERT/CC is currently unaware of a practical solution to this
problem.


Please consider the following workarounds:

Block outbound SMB

Consider blocking outbound SMB connections (TCP ports 139 and 445 along
with UDP ports 137 and 138) from the local network to the WAN.


Vendor Information (Learn More)

Vendor                   Status      Date Notified     Date Updated

Microsoft Corporation   Affected     01 Feb 2017       02 Feb 2017


If you are a vendor and your product is affected, let us know.


CVSS Metrics (Learn More)

Group Score Vector

Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal 9.0 E:POC/RL:U/RC:C

Environmental 9.0 CDP:ND/TD:H/CR:ND/IR:ND/AR:ND


References

https://github.com/lgandx/PoC/tree/master/SMBv3%20Tree%20Connect
https://msdn.microsoft.com/en-us/library/cc246499.aspx
https://www.us-cert.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices


Credit

This vulnerability was publicly reported by PythonResponder.

This document was written by Will Dormann.


==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================