Microsoft Security Advisory (977544)

What is the scope of the advisory?
Microsoft is aware of a new vulnerability report affecting the Microsoft Server Message Block (SMB) protocol. This affects the operating systems listed in the Affected Software section.

Is this a security vulnerability that requires Microsoft to issue a security update? 
Microsoft is currently working to develop a security update for Windows to address this vulnerability. Microsoft will release the security update once it has reached an appropriate level of quality for broad distribution.

Is this advisory related to MS09-050, released on October 13, 2009? 
No. Microsoft Security Bulletin MS09-050, "Vulnerability in SMBv2 Could Allow Remote Code Execution," addresses a remote code execution vulnerability in the SMBv2 server service. This advisory details a denial of service in the SMB client. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate their user rights, but it could cause the affected system to stop responding until manually restarted.

What versions of SMB does this advisory address?
The issue discussed in this advisory affects both SMBv1 and SMBv2.

What is Microsoft Server Message Block (SMB) protocol? 
Microsoft Server Message Block (SMB) protocol is a Microsoft network file sharing protocol used in Microsoft Windows. For more information on SMB, see Microsoft SMB Protocol and CIFS Protocol Overview.

What is Server Message Block Version 2 (SMBv2)? 
Server Message Block (SMB) is the file sharing protocol used by default on Windows-based computers. SMB Version 2.0 (SMBv2) is an update to this protocol, and is only supported on computers running Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. SMBv2 can only be used if both client and server support it. If either client or server cannot support SMBv2, the SMB 1.0 protocol will be used instead. The SMB protocol version to be used for file operations is decided during the negotiation phase. During the negotiation phase, a Windows client advertises to the server that it can understand the new SMBv2 protocol. If the server understands SMBv2, then SMBv2 is chosen for subsequent communication. Otherwise the client and server use SMB 1.0 and continue to function as normal. For more information on SMBv2, see the MSDN article, Server Message Block (SMB) Version 2 Protocol Specification.

What is the difference between SMBv1 and SMBv2?
Both protocols are used by clients to request file and print services from a server system over the network. Both are stateful protocols in which clients establish a connection to a server, establish an authenticated context on that connection, and then issue a variety of requests to access files, printers, and named pipes for interprocess communication. The SMBv2 protocol is a major revision of the existing SMB protocol. While many of the underlying concepts are the same, the packet formats are completely different. In addition to providing all of the capabilities found in SMBv1, the SMBv2 protocol provides several enhancements:

What causes this threat? 
The vulnerability is caused by the Microsoft Server Message Block (SMB) protocol software insufficiently validating all fields when parsing specially crafted SMB packets.

What might an attacker use this vulnerability to do?
An attacker who successfully exploited this vulnerability could cause a user's system to stop responding until manually restarted.

Can this vulnerability be exploited using Internet Explorer?
No. However, this issue may be exploited through Web transactions, regardless of browser type. In a Web-based attack scenario, an attacker would have to host a Web page that contains a specially crafted URI. A user that browsed to that Web site will force an SMB connection to an SMB server controlled by the attacker, which would then send a malicious response back to the user. This response would cause the user's system to stop responding until manually restarted. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince them to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes them to the attacker's site.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of this issue. The following mitigating factors may be helpful in your situation:

Workaround refers to a setting or configuration change that does not correct the underlying issue but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality: