Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 116 views

    Synopsis: 79638 - MS14-066: Vulnerability in Schannel Could Allow Remote Code Execution (2992611) (Uncredentialed Check)

    Uploaded by

    Yulian Sani
    The remote Windows host is affected by multiple remote code execution and information disclosure vulnerabilities in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of SMBv1 packets. An unauthenticated, remote attacker can exploit these vulnerabilities to disclose sensitive information or execute arbitrary code by sending a specially crafted SMBv1 packet. The host should apply the applicable security update according to its Windows version to resolve these vulnerabilities.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Synopsis: 79638 - MS14-066: Vulnerability in Schannel Could Allow Remote Code Execution (2992611) (Uncredentialed Check)

    Uploaded by

    Yulian Sani
    116 views3 pages
    The remote Windows host is affected by multiple remote code execution and information disclosure vulnerabilities in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of SMBv1 packets. An unauthenticated, remote attacker can exploit these vulnerabilities to disclose sensitive information or execute arbitrary code by sending a specially crafted SMBv1 packet. The host should apply the applicable security update according to its Windows version to resolve these vulnerabilities.

    Original Title

    Critical Finding

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The remote Windows host is affected by multiple remote code execution and information disclosure vulnerabilities in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of SMBv1 packets. An unauthenticated, remote attacker can exploit these vulnerabilities to disclose sensitive information or execute arbitrary code by sending a specially crafted SMBv1 packet. The host should apply the applicable security update according to its Windows version to resolve these vulnerabilities.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    116 views3 pages

    Synopsis: 79638 - MS14-066: Vulnerability in Schannel Could Allow Remote Code Execution (2992611) (Uncredentialed Check)

    Uploaded by

    Yulian Sani
    The remote Windows host is affected by multiple remote code execution and information disclosure vulnerabilities in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of SMBv1 packets. An unauthenticated, remote attacker can exploit these vulnerabilities to disclose sensitive information or execute arbitrary code by sending a specially crafted SMBv1 packet. The host should apply the applicable security update according to its Windows version to resolve these vulnerabilities.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 3

    79638 - MS14-066: Vulnerability in Schannel Could Allow Remote Code Execution (2992611)

    (uncredentialed check)

    Synopsis
    The remote Windows host is affected by a remote code execution vulnerability.

    Description
    The remote Windows host is affected by a remote code execution vulnerability due to improper
    processing of packets by the Secure Channel (Schannel) security package. An attacker can exploit this
    issue by sending specially crafted packets to a Windows server. Note that this plugin sends a client
    Certificate TLS handshake message followed by a CertificateVerify message. Some Windows hosts will
    close the connection upon receiving a client certificate for which it did not ask for with a
    CertificateRequest message. In this case, the plugin cannot proceed to detect the vulnerability as the
    CertificateVerify message cannot be sent.
    97833 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE)
    (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks)
    (Petya) (uncredentialed check)

    Synopsis
    The remote Windows host is affected by multiple vulnerabilities.

    Description
    The remote Windows host is affected by the following vulnerabilities : - Multiple remote code execution
    vulnerabilities exist in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of certain
    requests. An unauthenticated, remote attacker can exploit these vulnerabilities, via a specially crafted
    packet, to execute arbitrary code. (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146,
    CVE-2017-0148) - An information disclosure vulnerability exists in Microsoft Server Message Block 1.0
    (SMBv1) due to improper handling of certain requests. An unauthenticated, remote attacker can exploit
    this, via a specially crafted packet, to disclose sensitive information. (CVE-2017-0147) ETERNALBLUE,
    ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation
    Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers.
    WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and
    EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware
    program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via
    ETERNALBLUE.

    Solution
    Microsoft has released a set of patches for Windows Vista, 2008, 7, 2008 R2, 2012, 8.1, RT 8.1, 2012 R2,
    10, and 2016. Microsoft has also released emergency patches for Windows operating systems that are no
    longer supported, including Windows XP, 2003, and 8. For unsupported Windows operating systems, e.g.
    Windows XP, Microsoft recommends that users discontinue the use of SMBv1. SMBv1 lacks security
    features that were included in later SMB versions. SMBv1 can be disabled by following the vendor
    instructions provided in Microsoft KB2696547. Additionally, US-CERT recommends that users block SMB
    directly by blocking TCP port 445 on all network boundary devices. For SMB over the NetBIOS API, block
    TCP ports 137 / 139 and UDP ports 137 / 138 on all network boundary devices.
    100464 - Microsoft Windows SMBv1 Multiple Vulnerabilities

    Synopsis
    The remote Windows host is affected by multiple vulnerabilities.

    Description
    The remote Windows host has Microsoft Server Message Block 1.0 (SMBv1) enabled. It is, therefore,
    affected by multiple vulnerabilities : - Multiple information disclosure vulnerabilities exist in Microsoft
    Server Message Block 1.0 (SMBv1) due to improper handling of SMBv1 packets. An unauthenticated,
    remote attacker can exploit these vulnerabilities, via a specially crafted SMBv1 packet, to disclose
    sensitive information. (CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-
    0274, CVE-2017-0275, CVE-2017-0276) - Multiple denial of service vulnerabilities exist in Microsoft
    Server Message Block 1.0 (SMBv1) due to improper handling of requests. An unauthenticated, remote
    attacker can exploit these vulnerabilities, via a specially crafted SMB request, to cause the system to stop
    responding. (CVE-2017-0269, CVE-2017-0273, CVE-2017-0280) - Multiple remote code execution
    vulnerabilities exist in Microsoft Server Message Block 1.0 (SMBv1) due to improper handling of SMBv1
    packets. An unauthenticated, remote attacker can exploit these vulnerabilities, via a specially crafted
    SMBv1 packet, to execute arbitrary code. (CVE-2017-0272, CVE-2017-0277, CVE-2017-0278, CVE-
    2017-0279) Depending on the host's security policy configuration, this plugin cannot always correctly
    determine if the Windows host is vulnerable if the host is running a later Windows version (i.e., Windows
    8.1, 10, 2012, 2012 R2, and 2016) specifically that named pipes and shares are allowed to be accessed
    remotely and anonymously. Tenable does not recommend this configuration, and the hosts should be
    checked locally for patches with one of the following plugins, depending on the Windows version :
    100054, 100055, 100057, 100059, 100060, or 100061.

    Solution
    Apply the applicable security update for your Windows version :
    - Windows Server 2008 : KB4018466
    - Windows 7 : KB4019264
    - Windows Server 2008 R2 : KB4019264
    - Windows Server 2012 : KB4019216
    - Windows 8.1 / RT 8.1. : KB4019215
    - Windows Server 2012 R2 : KB4019215
    - Windows 10 : KB4019474
    - Windows 10 Version 1511 : KB4019473
    - Windows 10 Version 1607 : KB4019472
    - Windows 10 Version 1703 : KB4016871
    - Windows Server 2016 : KB4019472

    You might also like