Mohamed Sharaf
Menu
Security

SMBGhost: patch Windows 10 file sharing today

A wormable bug in Windows 10’s SMBv3 compression leaked before a fix. Microsoft has now released the patch.

· 1 min read

On Tuesday details of a serious bug in SMBv3 leaked before a patch was ready. Today Microsoft released the fix for CVE-2020-0796, known as SMBGhost. It affects Windows 10 and Windows Server versions 1903 and 1909.

It’s called wormable for a reason: a vulnerable machine could be attacked over the network without any login, and malware could spread from one PC to the next on its own, like WannaCry in 2017.

  1. Install today’s update on Windows 10 and Server 1903/1909.
  2. If you can’t yet, disable SMBv3 compression on servers with the PowerShell setting Microsoft published.
  3. Block TCP port 445 at your internet edge. File sharing should never be open to the internet.
  4. Inside the network, limit which machines can reach each other on 445. Laptops rarely need to talk to other laptops.
ShareWhatsAppLinkedInXTelegramFacebook