Skip to content
OpenAdvisories
Critical MSRC-CVE-2022-35804 1 CVE

SMB Client and Server Remote Code Execution Vulnerability

Published Aug 9, 2022 · Updated Aug 9, 2022

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

How could an attacker exploit the vulnerability?
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target system. This vulnerability can be exploited through two different vectors:

What steps can I take to protect my network?
Block TCP port 445 at the enterprise perimeter firewall
TCP port 445 is used to initiate a connection with the affected component. Blocking this port at the network perimeter firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. This can help protect networks from attacks that originate outside the enterprise perimeter. Blocking the affected ports at the enterprise perimeter is the best defense to help avoid Internet-based attacks. However, systems could still be vulnerable to attacks from within their enterprise perimeter.
Secure SMB Traffic in Windows Server: *https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-secure-traffic
No.

Security updates
10.0.22000.856 — https://support.microsoft.com/help/5016629

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References