Recently US-CERT or United States Computer Emergency Readiness Team has found a zero-day vulnerability present in SMB service of the Microsoft Windows that allows an attacker to carry out a Denial of Service attack and crash the entire system thus leading to Blue Screen of Death (BSOD).
The CERT’s advisory specifies this by saying “by connecting to malicious SMB (Server Message Block) server , a vulnerable Windows client system can crash BSOD in mrxsmb20.sys.”
Further, making use of this vulnerability, an attacker can launch attacks of all sorts and also execute arbitrary code. This vulnerability makes the Windows 10 and Windows 8.1 exposed to exploitation and also may affect Windows Server systems.
The advisory also said that the Microsoft Windows has already failed to handle traffic coming from infected or malicious server properly and it also cannot handle server response which contains too many bytes “following this structure defined in the SMB2 TREE_CONNECT Response structure.”
The team CERT also reproduced this attack method by performing a denial of service attack onto the computers running the patched versions of Windows 10 and Windows 8.1. But, the team was not succesful in running the arbitary code.
The problem may worsen now since the exploit code that may let attackers take advantage of this zero-day vulnerability is already available online and therefore, a patch for the flaw is required badly. Until then, US-CERT cannot provide a solution to keep the users safe. It, however, has provided a temporary fix in the form of blocking outbound SMB connections on the local network.