Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/technion/disablesmbcompression
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates
https://github.com/technion/disablesmbcompression
Last synced: about 2 months ago
JSON representation
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates
- Host: GitHub
- URL: https://github.com/technion/disablesmbcompression
- Owner: technion
- License: mit
- Created: 2020-03-11T03:43:29.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2020-03-11T04:57:07.000Z (almost 5 years ago)
- Last Synced: 2024-11-01T11:34:24.963Z (2 months ago)
- Size: 49.8 KB
- Stars: 8
- Watchers: 5
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# DisableSMBCompression
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates
The little we know about the new SMB3 flaw, is that we've been provided this mitigation for SMB3 servers:
```
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
```
This repository contains ADMX templates to provide a nice interface to this setting. This allows easy mass deployment of the given mitigation, and easy rollback when desired.
# Installation
See this Microsoft guide for installing new admx files:
https://support.microsoft.com/en-au/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra
Under "Administrative Templates", find the new "SMB Compression Support" setting as below.
# Applicability
I recommend careful consideration before deploying outside of Windows 10 machines. Windows 2016 Server is not vulnerable, and only the SAC builds of Windows 2019 (which are Server Core only) are considered vulnerable. There has been little (no) QA done on the impact of this setting on server roles such as S2D. As always, please test a small group before a larger deployment.
The majority of environments don't appear to be running SMB compression in practice, but please consider whether this is suitable to you.
# Limitations
Nothing described as a "mitigation" should be considered a complete fix. Please roll patches as soon as they are out. This change disables compression on the local SMB server, where Microsoft's guide appears to suggest this can still be exploited to attack the client. See Microsoft's guidance for further information.
# References:
https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005