Microsoft · SMBv3
A remote code execution flaw in Microsoft's SMBv3 protocol (Server Message Block 3.1.1) lies in how it handles certain requests, involving improper restriction of operations within the bounds of a memory buffer. An attacker who can reach the affected SMBv3 client or server over the network, without needing credentials or any user interaction, can execute code on the target.
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
First seen exploited 3 months after disclosure. Public exploit code (PoC-in-GitHub) was available 4 months before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Remote network exploitation of SMBv3 protocol
remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2020-0796 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Four images were there for all to see: an email icon, screenshot from a game with Russian text, screenshot of the site of a game development company, and a screenshot of information about vulnerability CVE-2020-0796 from the Microsoft website.
Mentions the CVE; no further detail.
2 passages name itOriginal (opens in a new tab) ↗
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.