CVE-2020-0796: New Wormable Vulnerability in SMBv3 Alert

On March 11, 2020, we detected a security rule announcement issued by the Fortiguard. The notice described a memory corruption vulnerability in Microsoft SMBv3 protocol, numbered CVE-2020-0796, and stated that the vulnerability does not require authorization verification, used remotely, it may form a worm-level vulnerability.

CVE-2020-0796 – a "wormable" SMBv3 vulnerability.
Great…
😂 pic.twitter.com/E3uPZkOyQN

— MalwareHunterTeam (@malwrhunterteam) March 10, 2020

The advisory published by Fortinet:

This indicates an attack attempt to exploit a Buffer Overflow Vulnerability in Microsoft SMB Servers.
The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet. A remote, unauthenticated attacker can exploit this to execute arbitrary code within the context of the application.

Affected version

Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows Server, version 1903 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows Server, version 1909 (Server Core installation)

In view of the fact that Microsoft has not described the vulnerability numbered CVE-2020-0796, it is temporarily uncertain whether this vulnerability exists. We recommend that users keep an eye on the development of this vulnerability event.

The advisory published by Microsoft:

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.