Sunday, May 28, 2017

Windows SMB Remote Code Execution Vulnerability



1.

SMB Security Best Practices

Original release date: January 16, 2017 | Last revised: March 16, 2017

In response to public reporting of a potential Server Message Block (SMB) vulnerability, US-CERT is providing known best practices related to SMB. This service is universally available for Windows systems, and legacy versions of SMB protocols could allow a remote attacker to obtain sensitive information from affected systems.

US-CERT recommends that users and administrators consider:
  • disabling SMBv1 and
  • blocking all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices.

US-CERT cautions users and administrators that disabling or blocking SMB may create problems by obstructing access to shared files, data, or devices. The benefits of mitigation should be weighed against potential disruptions to users. For more information on SMB, please review Microsoft Security Advisories 2696547 and 204279.


Original page:
SMB Security Best Practices

2.

How to remove SMB v1 in Windows 8.1, Windows 10, Windows 2012 R2, and Server 2016


Caution! Don’t forget to reboot the targeted systems.

Windows Server: Server Manager method:
Uncheck Features SMB 1.0:


Windows Client: Add or Remove Programs method:
Uncheck Features SMB 1.0:



Windows Client: PowerShell method:

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol


Note You must restart the computer after you make these changes.

How to remove SMB v1 in Windows 7, Server 2008 R2, Windows Vista, and Server 2008


PowerShell method:
Windows PowerShell 2.0 or a later

To disable SMBv1 on the SMB server, run the following cmdlet:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force

Note You must restart the computer after you make these changes.

Registry method:

To enable or disable SMBv1 on the SMB server, configure the following registry key:
Registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled

 Note You must restart the computer after you make these changes.

Original page with other methods:
How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server

3.

Disabling NetBIOS over TCP/IP


Use the following steps to disable NetBIOS over TCP/IP; this procedure forces all SMB traffic to be direct hosted. Take care in implementing this setting because it causes the Windows-based computer to be unable to communicate with earlier operating systems using SMB traffic:

1. Open Network and Sharing Center and then click Change adapter settings.
2. Right-click Ethernet adapter, and then click Properties.
3. Click Internet Protocol (TCP/IP), and then click Properties.
4. Click Advanced.
5. Click the WINS tab, and then click Disable NetBIOS over TCP/IP.
6. Repeat for all relevant adapters as NetBT_Tcpip is bound to each adapter individually.



Original page: Direct hosting of SMB over TCP/IP
4.

Disabling certain TCP ports via firewall


How to disable Ports 135, 137, 138, 139, 445 via the Firewall

A.) TCP ports 135, 137, 139
1. Open the Control Panel.
2. Click the Windows Firewall.
3. Click Advanced settings.
4. Click Inbound Rule.
5. On the right side, click New rule.
6. Chose the Port.
7. Click Next.
8. Choose Specific local ports.
9. Click TCP radio-button above and type 135, 137, 139
10. Click Next.
11. Choose Block the connection.
12. Click Next.
13. Tick the three checkboxes and click Next.
14. Type My rule: Close TCP ports 135, 137, 139 into the Name box.
15. Click Finish.

B.) TCP port 445
1. Open the Control Panel.
2. Click the Windows Firewall.
3. Click Advanced settings.
4. Click Inbound Rule.
5. On the right side, click New rule.
6. Chose the Port.
7. Click Next.
8. Choose Specific local ports.
9. Click TCP radio-button above and type 445
10. Click Next.
11. Choose Block the connection.
12. Click Next.
13. Tick the three checkboxes and click Next.
14. Type My rule: Close TCP port 445 into the Name box.
15. Click Finish.

C.) UDP ports 137, 138
1. Open the Control Panel.
2. Click the Windows Firewall.
3. Click Advanced settings.
4. Click Inbound Rule.
5. On the right side, click New rule.
6. Chose the Port.
7. Click Next.
8. Choose Specific local ports.
9. Click UDP radio-button above and type 137, 138
10. Click Next.
11. Choose Block the connection.
12. Click Next.
13. Tick the three checkboxes and click Next.
14. Type My rule: Close UDP ports 137, 138 into the Name box.
15. Click Finish.





5.

Microsoft Security Bulletin MS17-010 - Critical


Security Update for Microsoft Windows SMB Server (4013389)
Published: March 14, 2017

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.


Security update deployment

Here are the links to the available MS17-010 updates for all of the Windows versions:



Prerequisites:
KB2919442 and KB2919355


All future security and non-security updates for Windows 8.1 and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you installupdate 2919355
https://support.microsoft.com/en-us/help/2919355
on your Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.

If you install a language pack after you install this update, you must reinstall this update.

Before applying KB2919355 update, you must have the following update installed on Windows RT 8.1, Windows 8.1, or Windows Server 2012 R2:
KB2919442
https://support.microsoft.com/en-us/help/2919442
A servicing stack update is available for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2: March 2014


Important: When you install this update from Windows Update, updates 2932046, 2937592, 2938439, 2934018, and 2959977 are included in the installation.

Important This update (2919355) replaces update 2883200 . You don't have to install update 2883200 after you install this update.

You can obtain the stand-alone update package through the Microsoft Download Center.

Download Download the x86-based Windows 8.1 update package

http://www.microsoft.com/downloads/details.aspx?familyid=47b21d89-3f78-477f-9402-8021e61bef59

Download Download the x64-based Windows 8.1 update package

http://www.microsoft.com/downloads/details.aspx?familyid=f2917221-a8b3-4024-b755-818ad0e7703d

Download Download the x64-based Windows Server 2012 R2 update package

http://www.microsoft.com/downloads/details.aspx?familyid=373b1bb0-6d55-462e-98b7-6cb7d9ef1448

Note The updates must be installed in the following order:
clearcompressionflag.exe
KB2919355
KB2932046
KB2959977
KB2937592
KB2938439
KB2934018

clearcompressionflag.exe
38 KB
Windows8.1-KB2919355-x64.msu
690.8 MB
Windows8.1-KB2932046-x64.msu
48.0 MB
Windows8.1-KB2934018-x64.msu
126.4 MB
Windows8.1-KB2937592-x64.msu
303 KB
Windows8.1-KB2938439-x64.msu
19.6 MB
Windows8.1-KB2959977-x64.msu
2.8 MB

Date Published:
5/5/2014


KB2919442 is a prerequisite for Windows Server 2012 R2 Update and should be installed before attempting to install KB2919355

Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update KB2919355 original page:
https://support.microsoft.com/en-us/help/2919355

April 2014

To confirm the exact version of Windows Server 2012 R2 that is installed on a computer, run Msinfo32.exe
If Windows Server 2012 R2 Update is installed, the value reported for Hardware Abstraction Layer will be
6.3.9600.17031

- End of prerequisites section - 
 

Security Update for Microsoft Windows SMB Server (4013389)
Windows Server 2012 R2 (all editions)


For all supported editions of Windows Server 2012 R2 download:
Windows8.1-KB4012213-x64.msu
Security only

or

For all supported editions of Windows Server 2012 R2 download montly rollup containing this update, currently it is windows8.1-kb4019215 or previous one Windows8.1-KB4012216


A system restart is required after you apply this security update.

March 2017 Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2
https://support.microsoft.com/en-us/help/4012213/march-2017-security-only-quality-update-for-windows-8-1-and-windows-server-2012-r2


File name:
Windows8.1-KB4012213-x64.msu
SHA1 hash:
5B24B9CA5A123A844ED793E0F2BE974148520349
SHA256 hash
9570C588FECFF58831F989BA62B0743495B366DEFC382F5DC12FF50E0F9BED9B
File name:
Windows8.1-KB4012213-x86.msu
SHA1 hash
E118939B397BC983971C88D9C9ECC8CBEC471B05
SHA256 hash
DD770131CD4E87F9D8ED8038427F8952905EF31C9BC6E3D32C88FD71F9984EFB

File download page:
http://www.catalog.update.microsoft.com/search.aspx?q=4012213



To determine whether MS17-010 fixes have been installed:

Check by installed Knowledge Base number for any of the listed updates that contain MS17-010 patch.

To check by Windows PowerShell method enter this PowerShell command:

get-hotfix -id KB4012212,KB4012213

If you installed a rollup that contains MS17-010, check for one of applied updates, for example (May 2017):

get-hotfix -id KB4012213,KB4012216,KB4012219,KB4015550,KB4015553,KB4019213,KB4019215



To check for some of previous Server 2012R2 and Windows 8.1 updates:

get-hotfix -id KB2919442



get-hotfix -id KB2919355,KB2959977,KB2919442




How do you really know a machine is vulnerable (or not)?

The nmap script smb-vuln-ms17-010 detects Microsoft SMBv1 hosts vulnerable to a remote code execution vulnerability (ms17-010). First of all make sure you have a recent version of Nmap (version 7.40 or later). Then download the script smb-vuln-ms17-010 from its github repository and place it in your NSE script directory:

Linux - /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
OSX - /usr/local/share/nmap/scripts/ or /opt/local/share/nmap/scripts/
Windows - C:\Program Files\Nmap\scripts\

To install the script in your system:

#nmap --script-updatedb

To detect if a machine is vulnerable, run the following Nmap command:

$nmap -v --script smb-vuln-ms17-010 -p445

Here is an unpatched machine before and after applying some mitigating measures:



A "fully vulnerable" host may return the following script results:
| smb-vuln-ms17-010:
| VULNERABLE:

Posted by at
Labels: , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)