Hello, welcome to the Wednesday, March 11, 2020 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Well, at first glance, today's Microsoft Patch Tuesday looks rather average.

Yes, 117 vulnerabilities. 25 of them are rated critical, but none of the vulnerabilities were disclosed publicly before today, and also Microsoft has not seen any exploits against vulnerabilities being patched today. The vulnerabilities themselves look, well, sort of like

your average bunch of vulnerabilities for a patch Tuesday. Lots of fixes to the scripting engine,

a couple of vulnerabilities in office, Word, Excel, and the like. So overall, very average,

if it wouldn't be for a rather odd leak.

Now, this was first sort of noticed by some people on Twitter that the Cisco Talis research team

published a blog post indicating that one of the vulnerabilities CVE 2020 0796 is an

unauthenticated remote code exploitation vulnerability in the SMB version 3 protocol.

That's of course another sort of blue keep type vulnerability and something that's certainly serious.

Now, this CVE number is actually assigned in Microsoft's release to a link vulnerability that doesn't look like it has anything at all to do with SMB or SMB version 3.

So where does this all resolve?

Well, Microsoft also published a security advisory.

This advisory, 2000-0-05, I guess, is the right number for it it does describe the vulnerability that the Cisco Talis

block originally hinted on and that's that there is a vulnerability in current versions

of Windows in the SMB version 3 client as well as server that can be exploited

without all vacation. So yes, another blue keep. And there is no patch apparently. There's

also no CVE number in Microsoft's advisory. Instead, Microsoft says that you should turn off compression

for SMP version 3 and that'll protect your servers from exploitation, but clients continue

to be vulnerable. And in order to attack a client that's a little bit more tricky, you need

to get a user to actually connect to a malicious Smb server. Now, just a little bit about different

...