High
CVE-2020-1206 Windows SMBv3 Client/Server Information Disclosure Vulnerability
CVE-2020-1206 Windows SMBv3 Client/Server Information Disclosure Vulnerability
Description
An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka ‘Windows SMBv3 Client/Server Information Disclosure Vulnerability’.
Add Assessment
Technical Analysis
Edit: After writing this @adfoster-r7 pointed out that Zecops has a writeup on exactly how to chain this with SMBGhost. How apropos! https://blog.zecops.com/vulnerabilities/smbleedingghost-writeup-chaining-smbleed-cve-2020-1206-with-smbghost/
Note that if you were already patched against CVE-2020-0796, the current PoCs aren’t going to be impactful to you, so the urgency is lower than if you’re a couple of months out of date. If you’re patching already, no need to panic.
Whenever we see SMB memory corruption leaks, the cry is always ‘oh, if only we had an information leak, we could make this so much more reliable’. Well, assuming someone figures out the details, this could be the information leak folks are looking for to make SMBGhost and other vulnerabilities more reliable to exploit. Not a big deal by itself, but I imagine folks are already trying to figure out how to use this to an advantage. It might not take long given the existence of public SMBGhost PoCs already.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1903,
- windows 10 1909,
- windows 10 2004,
- windows server 2016 1903,
- windows server 2016 1909,
- windows server 2016 2004
Bumped the value and exploitability ratings here since the PoC got published showing the chain in action. Nice work! https://github.com/ZecOps/CVE-2020-0796-RCE-POC
The kept exploitability medium since there are still a few gotchas to keep in mind, such as it being tough to achieve reliability with > 1 core (when is the last time you bought a computer with 1 core?). You’ll likely see this more for exploiting VMs than, say, your average laptop or enterprise server. On the other hand, none of that prevented mass exploitation of BlueKeep, so be prepared for similar spray-and-pray type campaigns.