Comments on: Remote SMB Exploit: Crashing Windows 7 and Server 2008

By: Praetorian Prefect | Windows SMB Crash Video

Praetorian Prefect | Windows SMB Crash Video — Thu, 14 Jan 2010 05:27:11 +0000

[...] Back on November 11th, 2009 we confirmed Laurent Gaffié’s remote exploit for Windows that causes a kernel crash. The operating system actually freezes creating a denial of service when, for example, a user is tricked into clicking on a link on a web page to a malicious SMB share request. The SMB client goes into an infinite loop when processing this malformed request according to Microsoft. The video below demonstrates this effect, having a user click a web site link and showing the crash. [...]

By: Week 46 in Review – 2009 | Infosec Events

Week 46 in Review – 2009 | Infosec Events — Wed, 13 Jan 2010 06:03:01 +0000

[...] Remote SMB Exploit: Crashing Windows 7 and server 2008 – praetorianprefect.com [...]

By: Praetorian Prefect | First Patch Tuesday of 2010

Praetorian Prefect | First Patch Tuesday of 2010 — Tue, 12 Jan 2010 23:08:19 +0000

[...] announced in a blog post that the SMB bug which can crash Windows 7 and Server 2008 R2 will not be patched in January’s patch Tuesday. We have shown how this bug can cause a severe [...]

By: Praetorian Prefect | First Patch Tuesday of 2010

Praetorian Prefect | First Patch Tuesday of 2010 — Tue, 12 Jan 2010 23:08:19 +0000

[...] announced in a blog post that the SMB bug which can crash Windows 7 and Server 2008 R2 will not be patched in January’s patch Tuesday. We have shown how this bug can cause a severe [...]

By: Praetorian Prefect | SMB Bug won’t be patched in January

Praetorian Prefect | SMB Bug won’t be patched in January — Fri, 08 Jan 2010 18:07:54 +0000

[...] can crash Windows 7 and Server 2008 R2 will not be patched in January’s patch Tuesday. We have shown how this bug can cause a severe halt to the OS, however, Microsoft stated that they “are not [...]

By: Selvaggio Web » Blog Archive » Windows 7 paralizzabile da remoto: possibile? Sembra proprio di sì

Sat, 26 Dec 2009 12:04:30 +0000

[...] diversa da quella reale. E’ sufficiente un singolo byte di differenza, secondo i test di PraetorianPrefect.com. Se succede, l’unica cosa che si può fare è premere il pulsante di spegnimento del computer [...]

By: Praetorian Prefect | From Promiscuous to Port Scanning with Powershell

Praetorian Prefect | From Promiscuous to Port Scanning with Powershell — Sat, 05 Dec 2009 00:45:44 +0000

[...] on those items, but I haven’t thought of a reason to use them yet. Maybe we can convert Gaffie’s Python code that crashes Windows 7 into a Powershell script one [...]

By: Prima d’iniziare e già ci sono “bugs” per SEVEN « Scrittura « Il CriticaMente

Tue, 24 Nov 2009 07:43:10 +0000

[...] lunghezza diversa da quella reale. E' sufficiente un singolo byte di differenza, secondo i test di PraetorianPrefect.com. Se succede, l'unica cosa che si può fare è premere il pulsante di spegnimento del computer e poi [...]

By: Windows 7 paralizzabile da remoto via pacchetto malformato in SMB ? Facciamo il punto | Ultimissime

Fri, 20 Nov 2009 07:55:37 +0000

By: Windows 7 paralizzabile da remoto via pacchetto malformato in SMB ? Facciamo il punto | FDS

Fri, 20 Nov 2009 06:46:07 +0000

By: Falla SMB in Windows 7, quanto è grave? « Paoblog's Weblog

Falla SMB in Windows 7, quanto è grave? « Paoblog's Weblog — Fri, 20 Nov 2009 06:32:40 +0000

By: nckuhuahua

nckuhuahua — Fri, 20 Nov 2009 00:29:43 +0000

That is

By: nckuhuahua

nckuhuahua — Fri, 20 Nov 2009 00:28:13 +0000

You can simply place a

image

By: nckuhuahua

nckuhuahua — Fri, 20 Nov 2009 00:25:42 +0000

You can simply place a

image

By: Grosso bug di Windows 7 e Windows 2008 Server | Il Blog di Shift

Grosso bug di Windows 7 e Windows 2008 Server | Il Blog di Shift — Thu, 19 Nov 2009 10:13:08 +0000

[...] Crash, come viene chiamato. Eccovi la spiegazione dello scopritore G.Laurent, mentre sul sito di Praetorian Perfect potete trovare una spiegazione di come inchiodare una macchina in remoto. Ecco, in gergo tecnico, [...]

By: Pillole dal web – 17.11.2009 « Paoblog's Weblog

Pillole dal web – 17.11.2009 « Paoblog's Weblog — Tue, 17 Nov 2009 09:04:38 +0000

[...] appena ho tempo, ma comincio a segnalarvi un po’ di fonti: lo spiegone dello scopritore, il test, l’articolo di ZDNet, l’advisory di Microsoft. Chiudete le porte TCP da 135 a 139 e la [...]

By: Windows 7 First Zero-Day Vulnerability Crops Up | Complete Source

Windows 7 First Zero-Day Vulnerability Crops Up | Complete Source — Tue, 17 Nov 2009 04:37:10 +0000

[...] this exploit; interested folks can find more by Simon Price in his Praetorian Prefect post here or in this post in the SANS Diary by Rob [...]

By: 0-day SMB remote exploit in Windows 7 and Windows Server 2008 R2 « Technoblog.org

Fri, 13 Nov 2009 09:25:37 +0000

[...] http://isc.sans.org/diary.html?storyid=7573 http://blog.trendmicro.com/new-smb-zero-day-exploit/ http://praetorianprefect.com/archives/2009/11/how-to-crash-windows-7-and-server-2008/ [...]

By: Продолжение истории с SMB уязвимостью в Windows 7 | Сергей Шомин, блог

Продолжение истории с SMB уязвимостью в Windows 7 | Сергей Шомин, блог — Fri, 13 Nov 2009 05:27:52 +0000

[...] SMB уязвимость, о которой уже шла речь в начале сентября, подтвердилась на релизах Windows 7 и Server 2008 R2. Подробнее смотрите здесь и здесь. [...]

By: Simon Price

Simon Price — Thu, 12 Nov 2009 18:00:09 +0000

Sebastion: Nothing special has to be enabled, the default installation is prone to the crash. Note that the full code is on Laurent’s site, but if you do a cut and paste from there, you may have to fix some of the tabs (Python cares about the tabbing). Ensure that the line def handle is indented, and the five lines under that indented twice. The last two lines are not indented. Also, the code must run on a machine that does not have port 445 in use, so if you run the server on Windows, you have to stop the Server service and disable Netbios. Once you attempt to connect with ‘dir’ as mentioned in the post, complete freeze.

By: Sebastian

Sebastian — Thu, 12 Nov 2009 17:48:56 +0000

I tried it and didn't work.

Is it something special that has to be enabled in either win 7/2k8r2?

By: Simon Price

Simon Price — Thu, 12 Nov 2009 17:19:04 +0000

To MS_GUY: I have been a big proponent of Windows 7, having used it since early betas (2008 as well, see my post on using the CLI in Core edition). I was sad to have to write this post, however, this is a pretty significant miss in testing on Microsoft's part. You likely would not surf from Windows 2008, but you would indeed from Windows 7. For enterprise environments, the lesson here is to keep tight EGRESS rules as well, blocking everything outbound except the essentials (HTTP, HTTPS). The lesson for me is not to tout how wonderful the OS is until the first SP is released. :)

By: n0neXn0ne

n0neXn0ne — Thu, 12 Nov 2009 16:33:05 +0000

"And why would you surf the net from a production server anyway!"

To download patches on Tuesday!

^o^

By: MS_Guy

MS_Guy — Thu, 12 Nov 2009 14:57:14 +0000

This is typical of the bash MS crowd! And why would you surf the net from a production server anyway! Oh the sky is falling, the sky is falling!