Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
How could an attacker exploit the vulnerability?
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target system. This vulnerability can be exploited through two different vectors:
What steps can I take to protect my network?
Block TCP port 445 at the enterprise perimeter firewall
TCP port 445 is used to initiate a connection with the affected component. Blocking this port at the network perimeter firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. This can help protect networks from attacks that originate outside the enterprise perimeter. Blocking the affected ports at the enterprise perimeter is the best defense to help avoid Internet-based attacks. However, systems could still be vulnerable to attacks from within their enterprise perimeter.
Secure SMB Traffic in Windows Server: *https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-secure-traffic
No.
Security updates
10.0.22000.856 — https://support.microsoft.com/help/5016629
Vulnerabilities 1
-
High 8.8
SMB Client and Server Remote Code Execution Vulnerability
SMB Client and Server Remote Code Execution Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-35804 SMB Client and Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35804
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss