Zero-Day in Windows Leads to BSOD

  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  

 

Recently US-CERT or United States Computer Emergency Readiness Team has found a zero-day vulnerability present in SMB service of the Microsoft Windows that allows an attacker to carry out a Denial of Service attack and crash the entire system thus leading to Blue Screen of Death (BSOD).

The CERT’s advisory specifies this by saying  “by connecting to malicious SMB (Server Message Block) server , a vulnerable Windows client system can crash BSOD in mrxsmb20.sys.”

Further, making use of this vulnerability, an attacker can launch attacks of all sorts and also execute arbitrary code. This vulnerability makes the Windows 10 and Windows 8.1 exposed to exploitation and also may affect Windows Server systems.

The advisory also said that the Microsoft Windows has already failed to handle traffic coming from infected or malicious server properly and it also cannot handle server response which contains too many bytes “following this structure defined in the SMB2 TREE_CONNECT Response structure.”

The team CERT also reproduced this attack method by performing a denial of service attack onto the computers running the patched versions of Windows 10 and Windows 8.1. But, the team was not succesful in running the arbitary code.

The problem may worsen now since the exploit code that may let attackers take advantage of this zero-day vulnerability is already available online and therefore, a patch for the flaw is required badly. Until then, US-CERT cannot provide a solution to keep the users safe. It, however, has provided a temporary fix in the form of blocking outbound SMB connections on the local network.

 

The following two tabs change content below.

William Fieldhouse

I currently work full time as a penetration tester and have been involved within the IT security industry for over a decade. I also love to pioneer any forms of new technology and ideologies for future advancements. Feel free to contact me at [email protected]

William Fieldhouse

I currently work full time as a penetration tester and have been involved within the IT security industry for over a decade. I also love to pioneer any forms of new technology and ideologies for future advancements. Feel free to contact me at [email protected]

Leave a Reply