US-CERT - Warning, Shadow Brokers Hackers are offering an SMB Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-6366 | SNMP Buffer Overflow RCE (EXTRABACON) in Cisco ASA, PIX, and FWSM Firewalls CVE-2016-6366, known as EXTRABACON (Cisco Bug ID CSCva92151), is a classic buffer overflow (CWE-120) in the SNMP processing of Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3, which runs on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices. A remote, authenticated attacker who knows the device's SNMP credentials (community string or SNMP user) can send crafted IPv4 SNMP packets that trigger the overflow and execute arbitrary code on the firewall, yielding full device control (CVSS 3.1: 8.8, high impact to confidentiality, integrity, and availability). Because these firewalls typically sit at the network perimeter, compromise gives attackers a chokepoint for traffic interception and further lateral movement, so any organization running affected ASA/PIX/FWSM software with SNMP enabled and reachable is at risk. A public exploit was released in 2016 in connection with the Shadow Brokers disclosures of Equation Group tooling, and CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-05-24, confirming exploitation in the wild. The high EPSS score of 87.6% (100th percentile) combined with the KEV listing indicates elevated near-term exploitation risk, making patching urgent. Do: Upgrade Cisco ASA Software to a fixed release for Bug ID CSCva92151 per Cisco's security advisory (all versions through 9.4.2.3 are affected), and apply the corresponding vendor fixes for ASA 1000V, PIX, and FWSM as required by the CISA KEV listing. As interim mitigation, restrict SNMP access to trusted management hosts via ACLs, disable SNMP where unused, prefer SNMPv3 with strong credentials over v1/v2c community strings, and review devices for indicators of compromise such as unexplained configuration changes or added user accounts. | 8.8 | 88% | KEV PoC ×3 |
| mass≈1M+ deployed ASA/PIX/FWSM devices (multi-million-unit ASA installed base; historically tens of thousands of ASA management interfaces exposed on the public… |
Full article571 words · extracted from securityaffairs.com · click to collapse
The US-CERT has issued a warning after the Shadow Brokers hackers have offered to sell what it claims to be an SMB Zero-Day exploit.
The United States Computer Emergency Readiness Team (US-CERT) has issued a warning after the Shadow Brokers hacker group has offered to sell what it claims to be an SMB Zero-Day exploit.
The Shadow Brokers is the hacker crew that leaked a portion of the arsenal of the NSA-Linked Equation Group, a database containing hacking tools and exploits.
A few days ago the notorious hacker group Shadow Brokers announced the sale of an archive of Windows exploits and hacking tools stolen from the Equation group.
The mysterious hacking group has apparently decided to put an end to their failed attempts to sell exploits and hacking tools they claimed to have stolen from the NSA-linked Equation Group.
While the group claims to have decided to retire, the stolen exploits are still up for sale for the price of 10,000 bitcoins (roughly $8.7 million at the current exchange).
The precious archive seems to include also a zero-day exploit targeting the Server Message Block (SMB) network file sharing protocol.
“In response to public reporting of a potential Server Message Block (SMB) vulnerability, US-CERT is providing known best practices related to SMB. This service is universally available for Windows systems, and legacy versions of SMB protocols could allow a remote attacker to obtain sensitive information from affected systems,” US-CERT said.
Giving a close look at the list published by Shadow Brokers team it is possible to note a tool that claims to be an SMB Zero-Day exploit that goes for 250 bitcoins. The hackers describe the exploit as a remote code execution zero-day targeting SMB. The group is offering it under the name “SMB cloaked backdoor” for 50 bitcoins, but the complete package includes IIS, RDP RPC and SMB exploits for 250 bitcoins.
The US-CERT has advised users and administrators to consider disabling SMB v1, and block all versions of SMB at the network boundary. SMB typically uses port 445 (TCP/UDP), ports 137 and 138 (UDP), and port 139 (TCP).
The US-CERT provided the following recommendations to users and administrators:
- disabling SMB v1 and
- blocking all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices.
Anyway, it is important to consider that disabling or blocking SMB may create problems by obstructing access to shared files, data, or devices.
“The benefits of mitigation should be weighed against potential disruptions to users. For more information on SMB, please review Microsoft Security Advisories 2696547(link is external) and 204279(link is external).” continues the advisory.
The US-CERT has already issued in the past an alert following a Shadow Brokers initiative, in September it warned organizations after the hacker crew leaked exploitation tools flaws affecting Cisco ASA solutions.
“In August 2016, a group known as “Shadow Brokers” publicly released a large number of files, including exploitation tools for both old and newly exposed vulnerabilities. Cisco ASA devices were found to be vulnerable to the released exploit code. In response, Cisco released an update to address a newly disclosed Cisco ASA Simple Network Management Protocol (SNMP) remote code execution vulnerability (CVE-2016-6366).”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – SMB Zero-Day, ShadowBrokers)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/55454/hacking/smb-zero-day-exploit.html