# MA-778.032020: MyCERT Alert - CVE-2020-0796 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability

**Date:** 17 Mar 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-778.032020  
**Advisory ID:** MA-778.032020

---

**1.0 Introduction**
Microsoft has published a critical out-of band security update pertaining to a Remote Code Execution vulnerability targeting Microsoft Server Message Block 3.1.1 (SMBv3.1.1) Services. The vulnerability, (CVE-2020-0796) cause by improper handling of compression, may allow remote, unauthenticated attacker to execute arbitrary code. Earlier, Microsoft released security bulletin regarding this issue on 10th March 2020.
**2.0 Impact**
The vulnerability may allow a remote, unauthorized actor to execute arbitrary code on the target SMB server or SMB client.
**3.0 Affected System and Devices**
The affected system are as follows:
- Windows 10 Version 1903 for 32-bit Systems
- Windows 10 Version 1903 for ARM64-based Systems
- Windows 10 Version 1903 for x64-based Systems
- Windows 10 Version 1909 for 32-bit Systems
- Windows 10 Version 1909 for ARM64-based Systems
- Windows 10 Version 1909 for x64-based Systems
- Windows Server, version 1903 (Server Core installation)
- Windows Server, version 1909 (Server Core installation)
**4.0 Recommendations**
MyCERT recommends that system owners of vulnerable systems immediately apply the out-of-band security patches from Microsoft:
<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796>
It is further recommended that restrictions to  inbound / outbound TCP port 445 SMB traffic be implemented at the network border firewall.
Server that may not be patched immediately cause of operational reason may take action by disable SMBv3 compression. Disabling compression will block unauthenticated attackers from exploiting the vulnerability against SMBv3 Server by using PowerShell command as follow;
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
To avoid potential interruption of service, recommended workaround and patches should be tested with client systems before being deployed in a production environment. Details workaround instructions are also available on the Microsoft website as stated above.
Generally, MyCERT advises the users of this verstion to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796>
- <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005>
- <https://www.us-cert.gov/ncas/current-activity/2020/03/11/microsoft-server-message-block-rce-vulnerability>