Microsoft Windows SMBv3 Compression RCE (ADV200005)(CVE-2020-0796)(Remote)
High Nessus Plugin ID 134421
SynopsisThe remote Windows host is using a vulnerable version of SMB.
DescriptionA remote code execution vulnerability exists in Microsoft Server Message Block 3.1.1 (SMBv3) protocol due to how it handles a maliciously crafted compressed data packet. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.
Note, the plugin checks if SMB 3.1.1 with compression is enabled. It does not currently verify the vulnerability itself.
SolutionMicrosoft has provided additional details and guidance in the ADV200005 advisory.