Microsoft Windows Network File System v4 Remote Code Execution

https://www.thezdi.com/blog/2022/7/13/cve-2022-30136-microsoft-windows-network-file-system-v4-remote-code-execution-vulnerability

by todsacerdoti • 4 years ago

104 39 4 years ago

thezdi.com

GRBLDeveloped• 4 years ago

My thoughts go out to the sys admins patching this on a Friday

jlgaddis• 4 years ago

If they're just now patching it, I kinda feel like they deserve to spend their weekend patching Windows boxes.

This bug was patched by Microsoft in June 2022 ...

technion• 4 years ago

Just got some background here, the May 10th update literally broke the ability for many people to logon to a domain. It was extremely broken and businesses that deployed it suffered heavily. The June 14th fix being discussed here in turn broke many backup products in ways people are still trying to understand. Edit: The June 14th update being discussed here also broke Wifi hotspot and RRAS services, the latter being relevant to servers.

So most Windows server admins are quite acceptably delayed in deploying updates. Most standards and policies give an organisation 30 or 60 days to apply a security update outside of a particularly critical issue, and in most cases that's considered appropriate risk management. In this case I don't understand why this is news, there were many CVEs fixed this month but I've generally assessed there are as being very low exposure and no reason to panic. For example, across our whole fleet it took a few minutes to test for the NFS service being installed anywhere and I've found it in zero places.

We don't have the Linux luxury up running an "update Apache" command and getting an update that fixed one CVE, every update is a major cumulative update with its own brokenness and test cycles. Remember at one point Microsoft released an update which broke port binding, and every network service including their own SQL and SMTP servers stopped functioning. That update was rated a critical security fix.

The (edit) July 12th update is the first proper fix for Follina vulnerability, which is now months old. That really should be what people are testing and targetting for rollout.

imperialdrive• 4 years ago

You may have it backwards because in real life patching too soon can be equally risky, specifically with Microsoft products.

nibbleshifter• 4 years ago

Rolling out MS patches without a good testing period is a great way to suffer downtime in prod.

They somehow manage to ship catastrophically everything breaking shit extremely regularly.

ajsnigrutin• 4 years ago

Both admins using NFS on windows will be pissed off today :)

dboreham• 4 years ago

Note: N F S , not NTFS.

Presumably almost nobody has NFS enabled on a Windows box?

usrn• 4 years ago

idk people do weird stuff with windows servers and nfs.

pretext-1• 4 years ago

Didn't even know Windows could do that.

chungy• 4 years ago

Windows 2000 had NFS(v3) support. It's at least that old.

sumtechguy• 4 years ago

You need windows pro or higher, it is in one of the options dialogs.

bravetraveler2• 4 years ago

It's not that uncommon in lab environments, home or professional

Though you'll usually see samba/cifs more whenever Windows is involved

randombits0• 4 years ago

Who uses Windows NFS? I wouldn’t trust it and honestly, I can’t explain why, I just wouldn’t.

aaaaaaaaata• 4 years ago

Because you know not enough time has been spent on it.

acdha• 4 years ago

I don’t know anyone who loved it but if you were trying to get Linux desktops or servers allowed in a Windows shop it was often the path of least resistance.

rootw0rm• 4 years ago

i used it years ago for sharing media files from a windows server to a linux media player. bonus: said windows server also ran software raid-5. it's like i hit the lottery for worst possible solution for all the things.

croutonwagon• 4 years ago

I used it for years as a backup datastore location for some VM program. It worked well enough. Even had routine nightly shutdown/startup scripts of the VM that mounted it and then the NFS server.

It worked well enough. Would never run that at work or in production though.

acidburnNSA• 4 years ago

I use one. My windows heavy IT team likes to do big storage appliances in windows and serve them to linux vms with nfs. It is horrible and sketchy, and has all kind of weird file caching, permissions, and locking issues. They havent responded positively to my constant dropping of the ceph promo video on them.

https://www.youtube.com/watch?v=QBkH1g4DuKE

nairboon• 4 years ago

That video is great. Now I want to setup my own Ceph cluster.

bravetraveler2• 4 years ago

I don't disagree, but you would be truly shocked

justsomehnguy2• 4 years ago

This is the easiest way to share something with a *nix machine.

I use it for ISO storage in vSphere cluster, works fine.

People use it for storing actual VMs, but that requires a working AD/Krb integration between ESXi and AD which I don't use.

alophawen2• 4 years ago

Eh, CIFS (SMB) has been in the kernel for years and would be the easiest way to share Windows <-> Linux.

sneak• 4 years ago

Maybe because the CIFS/SMB clients for Linux are so good, it makes little sense to do it the other way 'round?

Fell• 4 years ago

If all you want is network storage in your home wifi, NFS is extremely easy to set up.

Last year, I wrote a blog post about it: https://furbasik.de/nfs-is-the-new-samba

I would not use it in an office though.

what-the-grump• 4 years ago

Someone with a San who didn’t want to deal with iscsi to the hypervisor. Who exactly, I can find a few clients that don’t listen to reason.

rougka2• 4 years ago

Seems like all the good zero days are in highly vintage components such as SMB, NFS, True Type Fonts and Windows Fax

If I were a security researcher I would look at anything that came from win 3.11, probably full of holes

sofixa• 4 years ago

NFS 4.1 isn't "highly vintage", the RFC is from 2010.

capableweb• 4 years ago

They're obviously not talking about specific versions, but the heritage of the protocols.

rougka2• 4 years ago

Maybe this example was not the best as it is only in Windows for 10 years, NFS however as a component exists since at least NT 4.

Even if this exploit only touches completely new code, my point still stands that windows has multiple layers of archeology which were designed when security was an afterthought.

Some of these are preinstalled with Windows, use networking and run as SYSTEM (WMI, spool) others are used by enough components in windows they will never be removed yet it doesn’t seem they are undergoing any development (COM/OLE)

saagarjha• 4 years ago

Brand new code often has vulnerabilities in it too.

mrjin• 4 years ago

Hmmm, there is such a thing in Windows...

Microsoft Windows Network File System v4 Remote Code Execution

Related Stories