Vulnerability Note VU#520465

Microsoft SMBv2 signing vulnerability

Overview

A vulnerability in the way Microsoft Server Message Block Version 2 (SMBv2) implements digital signing of packets may allow a remote, unauthenticated attacker to gain local user privileges and execute arbitrary code.

I. Description

Microsoft Server Message Block (SMB) Protocol is a network file sharing protocol used by default on Windows based computers. SMBv2 is supported on computers running Windows Server 2008 and Windows Vista. SMBv2 packet signing - used over all SMB communications - is critical for enabling recipients to verify the source and authenticity of the packet. A flaw exists in the way SMBv2 implements packet signing which may allow an attacker to modify a packet in transit, gain local user access to the system and execute arbitrary code.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code with local user privileges on an affected system.

III. Solution

Microsoft has published Microsoft Security Bulletin MS07-063 in response to this issue. Users are strongly encouraged to review this bulletin and apply the referenced patches.

In addition to the patches referenced above, Microsoft has published workarounds for this issue. Users who are unable to apply the patches are strongly encouraged to implement these workarounds as appropriate.

Systems Affected

Vendor	Status	Date Updated
Microsoft Corporation	Vulnerable	12-Dec-2007

References

http://www.microsoft.com/technet/security/bulletin/ms07-063.mspx
http://secunia.com/advisories/27997/

Credit

This vulnerability was reported by the vendor.

This document was written by Joseph W. Pruszynski.

Other Information

Date Public	12/11/2007
Date First Published	12/12/2007 03:35:10 PM
Date Last Updated	12/12/2007
CERT Advisory
CVE Name	CVE-2007-5351
Metric	9.05
Document Revision	12