The vulnerability was patched in March, but a new proof of concept raises the stakes for organizations that haven't yet updated their software.
Organizations with unpatched Windows 10 systems in their inventory now have an extra-large target on their corporate backs. According to a new alert from the Cybersecurity and Infrastructure Security Agency (CISA), an agency of the Department of Homeland Security, the target is in the shape of CVE-2020-0796 due to new proof-of-concept exploit code posted to GitHub.
The vulnerability is in the Microsoft Server Message Block 3.1.1 (SMBv3) protocol, a protocol used to allow Windows to communicate with a variety of devices. The vulnerability exploit, called SMBGhost, could allow an attacker to execute arbitrary code on the targeted server. To make matters worse, the exploit is "wormable," meaning that it can use infected hosts to spread copies of the exploit across an organization's network.
Microsoft issued a patch for CVD-2020-0796 in March, but tens of thousands of Windows 10 computers remain unpatched around the world. The release of the proof of concept into the wild means that these unpatched systems have made their owners victims-in-waiting. The DHS and Microsoft each urge owners to update their systems immediately.
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really bad day" in cybersecurity. Click for more information and to register.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024