Windows 10: Microsoft Guidance for Disabling SMBv3 Compression in Windows 10

Brink · Mar 10, 2020

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.

We will update this advisory when updates are available. If you wish to be notified when this advisory is updated, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Publicly Disclosed Exploited No No
Security Updates

To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.

Product Platform Article Download Impact Severity Supersedence Windows 10 Version 1903 for 32-bit Systems Remote Code Execution Critical Windows 10 Version 1903 for ARM64-based Systems Remote Code Execution Critical Windows 10 Version 1903 for x64-based Systems Remote Code Execution Critical Windows 10 Version 1909 for 32-bit Systems Remote Code Execution Critical Windows 10 Version 1909 for ARM64-based Systems Remote Code Execution Critical Windows 10 Version 1909 for x64-based Systems Remote Code Execution Critical Windows Server, version 1903 (Server Core installation) Remote Code Execution Critical Windows Server, version 1909 (Server Core installation) Remote Code Execution Critical
Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

The following workaround may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as they become available even if you plan to leave this workaround in place:

Disable SMBv3 compression

You can disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

Notes:

No reboot is needed after making the change.

This workaround does not prevent exploitation of SMB clients.

You can disable the workaround with the PowerShell command below.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 0 -Force

FAQ

What steps can I take to protect my network?

1. Block TCP port 445 at the enterprise perimeter firewall
TCP port 445 is used to initiate a connection with the affected component. Blocking this port at the network perimeter firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. This can help protect networks from attacks that originate outside the enterprise perimeter. Blocking the affected ports at the enterprise perimeter is the best defense to help avoid Internet-based attacks. However, systems could still be vulnerable to attacks from within their enterprise perimeter.

2. Follow Microsoft guidelines to prevent SMB traffic leaving the corporate environment
Guidelines for blocking specific firewall ports to prevent SMB traffic from leaving the corporate environment

Acknowledgements

Microsoft Platform Security Assurance & Vulnerability Research

See acknowledgements for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

Version Date Description 1.0 03/10/2020 Information published.
Click to expand...

Source: https://portal.msrc.microsoft.com/en...sory/ADV200005

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

:)

Analog_Interface · Mar 10, 2020

Microsoft Selects Dolby Audio for Windows 10

it would've been great if microsoft added HEVC decoders, LAV filters along with other codecs with Windows 10, and developing WMP to be better than VLC, KMPlayer and such sorts of media players.

Nevertheless, this is good step for microsoft, by far.

Ahhzz · Mar 10, 2020

Windows 10 Tweaks

As you may already know, Windows 10 (as well as Windows 8) allow you to log in with a valid Microsoft account, instead of creating a local account that only works on your machine. However, you may prefer to keep a local account for privacy reasons. If you do, though, some Windows 10 features—like Cortana—may not work. Despite the default behavior, the Windows 10 Store is not one of them. You can still log in to your Microsoft account for just the Store without switching to a full Microsoft account. The process, however, is not terribly obvious. To do so, follow these steps:

Launch the Store from your Start menu.

Click the user icon next to the search box.

Click “Sign-in” from the menu that appears.

Choose “Microsoft account” and log in like normal.

When the “Make it yours” box appears do not enter your password. Instead, click “Sign in to just this app instead.”

from Lifehacker

SerhiyIA · Mar 10, 2020

'System and compressed memory' on ASUS G75VY notebook load CPU always on 16%

thank you for your reply!

here what I did:

1. disabled non-microsoft services, disabled all applications in startup list

result: after restart "system and compressed memory" still gain 17% CPU

2. ran PC into safe mode ( just to see what happens )

result: CPU load is 0% for "system and compressed memory"

3. ran PC in normal mode

result: CPU load is 0% for "system and compressed memory"

as we can see from step 1, the problem probably is not in applications ?

what would you suggest in this case ?

looking forward for your answer

Windows 10: Microsoft Guidance for Disabling SMBv3 Compression in Windows 10

Microsoft Guidance for Disabling SMBv3 Compression in Windows 10

Microsoft Guidance for Disabling SMBv3 Compression in Windows 10

Microsoft Guidance for Disabling SMBv3 Compression in Windows 10

Microsoft Guidance for Disabling SMBv3 Compression in Windows 10 - Similar Threads - Microsoft Guidance Disabling

Microsoft guidance on planning for new capabilities in Windows 10

Disabling Win 10 Image Compression

SMBv3 multi sessions problem

Windows 10 KB4551762 SMBv3 patch is plagued with issues

Microsoft Compression Error

How to Disable SMBv1 and Have SMBv3 Take Over?

Is it ok if I disable Windows 10 memory compression?

Microsoft offers IT guidance to prepare for Windows as a Service

Enable or Disable NTFS File Compression in Windows

Users found this page by searching for:

smbv3 compression disable

where is the smbv3 compression located in windows 10

remote code execution vulnerability found in microsoft server message block 3.1.1 (smbv3)-cve-2020-0796