Functioning point-of-concept exploit code now exists for the highly critical "SMBGhost" bug that Microsoft last March patched in its Server Message Block 3.1.1 (SMBv3) protocol, and attackers are taking advantage, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned, citing open-source reports.
Designated CVE-2020-0796 and also known as EternalDarkness, the bug can result in a wormable remote code execution attack on a targeted SMB server or client. Microsoft on March 12 issued an out-of-band patch for the vulnerability after an apparent error in the Microsoft vulnerability disclosure process led to at least two cyber companies prematurely posting information about the flaw before Microsoft had the opportunity to publicly disclose the bug.
In addition to patching the vulnerability, CISA recommends that users employ a firewall to block SMB ports from the internet.
Please register to continue.
Already registered? Log in.
Once you register, you'll receive:
The context and insight you need to stay abreast of the most important developments in cybersecurity. CISO and practitioner perspectives; strategy and tactics; solutions and innovation; policy and regulation.
Unlimited access to nearly 20 years of SC Media industry analysis and news-you-can-use.
SC Media’s essential morning briefing for cybersecurity professionals.
One-click access to our extensive program of virtual events, with convenient calendar reminders and ability to earn CISSP credits.