Security News > 2020 > April > SMBGhost Vulnerability Allows Privilege Escalation on Windows Systems
Researchers have published proof-of-concept exploits to demonstrate that the Windows vulnerability tracked as SMBGhost and CVE-2020-0796 can be exploited for local privilege escalation.
The critical flaw, described as "Wormable" and related to the way SMB 3.1.1 handles certain requests, affects Windows 10 and Windows Server versions 1903 and 1909.
A PoC for remote code execution has yet to be made public, but cybersecurity firm ZecOps has developed and released a PoC that shows how SMBGhost can be exploited to escalate privileges to SYSTEM. Researchers Daniel García Gutiérrez and Manuel Blanco Parajón have also made available a PoC that exploits SMBGhost to escalate privileges to SYSTEM. ZecOps has also published a blog post with the technical details for local privilege escalation.
A scan conducted by cybersecurity company Kryptos Logic shortly after CVE-2020-0796 was disclosed revealed the existence of roughly 48,000 servers vulnerable to SMBGhost attacks.
Windows users can protect themselves against potential attacks by applying workarounds and mitigations shared by Microsoft or by installing the official patches.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-03-12 | CVE-2020-0796 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft Windows 10 and Windows Server 2016 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. | 7.5 |