Critical unpatched “wormable” remote code execution (RCE) vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3), dubbed EternalDarkness, disclosed by Microsoft. Update 03/13/2020: The Proof-of-concept section has been updated to reflect the public availability of an exploit script that can trigger a crash on a vulnerable system.

CVE-2020-0796: "Wormable" Remote Code Execution Vulnerability in Microsoft Server Message Block SMBv3 (ADV200005)

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

A remote code execution vulnerability exists in Microsoft Server Message Block 3.1.1 (SMBv3) protocol due to how it handles a maliciously crafted compressed data packet. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.

Note that this plugin works only if it can to connect to the IPC$ share anonymously using SMB dialect 3.1.1.

The remote Windows host is missing security update 4551762. It is, therefore, affected by a remote code execution vulnerability. The vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

A remote code execution vulnerability exists in Microsoft Server Message Block 3.1.1 (SMBv3) protocol due to how it handles a maliciously crafted compressed data packet. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.

Note, the plugin checks if SMB 3.1.1 with compression is enabled. It does not currently verify the vulnerability itself.

ID	Name	Product	Family	Severity
135177	Microsoft Windows SMBv3 Compression RCE (ADV200005)(CVE-2020-0796)(Remote)	Nessus	Windows	critical
134428	KB4551762: Windows 10 Version 1903 and Windows 10 Version 1909 OOB Security Update (ADV200005)(CVE-2020-0796)	Nessus	Windows : Microsoft Bulletins	critical
134421	Microsoft Windows SMBv3 Compression RCE (ADV200005)(CVE-2020-0796)(Remote)	Nessus	Windows	critical

Detections

Analytics

CVE-2020-0796

critical

Tenable Plugins

critical

critical

critical