Hello, welcome to the Wednesday, June 10th, 2020 edition of the Sansanet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Well, today, of course, top of the news, Microsoft's patch Tuesday, the gut patches for a total of 129 different vulnerabilities.

11 of them were rated critical and the remaining 118 were rated important.

So overall, this looks kind of like an average patch Tuesday if it wouldn't be for CVE 2020 1206. This is an un-initialized kernel

memory read for SMB version 3 and has already been named by the Discover Secops

SM plead. So what's so bad about this? Well, essentially it allows you to read

arbitrary kernel memory and proof of concept exploit has already been released by SECOps.

Of course, earlier this year we had a well somewhat somewhat similar vulnerability that led to remote code execution, and that was SMB Ghost CVE 2020-0796.

Same function actually, both of these vulnerabilities only affect SMB version 3 and affect the compression feature in SMB version 3. SMB ghost, the earlier

vulnerability led to code execution, of course more severe in that sense, and well, we got

actually just a proof of concept exploit for this one last week.

The new vulnerability, SM Pleat, does leak kernel memory.

So in essence, it's a little bit like, of course, Heartbleed, the famous OpenSSL vulnerability,

but here we get kernel memory, not memory from a specific process.

So those two vulnerabilities actually sort of go together, because with SM pleat, you can leak

kernel memory, which then allows you to actually exploit SMB ghost.

And with exploits being available for both, that certainly isn't a good thing.

So what should you do about it? Well, first of all, I hope you plug port 445 on your parameter.

I keep saying this. And earlier today, when I sort of was commenting on the SMB ghost proof of concept

in NewsBite, that's of the one thing I again pointed out. Now, if you still have compression

disabled in SMB version 3, there was one of the workarounds for the SMB ghost vulnerability,

...