Windows7 and Win2008 R2 0day surprise remote attack vulnerability

Microsoft's Patch Tuesday (Tuesday Patch Day) has just passed less than 24 hours, a security researcher announced a 0day bug from Windows 7 and Windows Server 2008 R2.

This flaw appears in the Server Message Block (SMB), which can be exploited by an attacker to remotely crash Windows 7 and Windows Server 2008 R2. LAN and Internet Explorer access can be done!

SMB Tips:

The Server Information Block (SMB) protocol is an IBM protocol for sharing files, printers, serial ports, etc. between computers. The SMB protocol can be used on the Internet's TCP/IP protocol or on other network protocols such as IPX and NetBEUI.

SMB A client/server, request/response protocol. Through the SMB protocol, client applications can read and write files on the server and make service requests to server programs in various network environments. In addition, through the SMB protocol, applications can access files on the remote server side, as well as resources such as printers, mailslots, and named pipes.

In a TCP/IP environment, the client connects to the server via NetBIOS over TCP/IP (or NetBEUI/TCP or SPX/IPX). Once the connection is successful, the client can send SMB commands to the server so that the client can access the shared directory, open files, read and write files, and everything else that can be done on the file system.

Starting with Windows 95, the Microsoft Windows operating system includes both client and server SMB protocol support. Microsoft provides the open source version of SMB for the Internet, the Common Internet File System (CIFS). CIFS is more flexible than existing Internet applications such as File Transfer Protocol (FTP). For UNIX systems, a shareware called Samba is available.

SMB defines two levels of security:

Share Level Protection applies to the server shared directory level. An access password is required for each shared directory. Only the password is passed and the client can access all shared files.

Usr Level Protection applies to individual files in a shared directory based on user access rights. Each user (client) must log in to the server and obtain a certified license for the server. Once the certification is passed, the client gets a UID. This UID is required during the subsequent client access to the server.