1

My firewall is dropping traffic from 3 terminals connected through SSL Client-2-Site VPN, because it detects " Microsoft Windows SMB CVE 2017-0016 Tree Connect Response denial of service vulnerability " .

The destination is a Domain Controller.

I have run a offline scan with Kaspersky rescue Disk, and nothing was found on 2 of them. What could be causing this alert?

  • You need someone to actually administer that firewall. You can make quite easy a rule allowing the needed ports to pass through. – Overmind Jul 19 '17 at 10:16
  • strangely I only have around 5 log entrances, with this issue. Each machine doing 1 to 3 attempts during the day. I don't have any user complain, that could be linked to this, So I will maintain the Firewall rule (LAN Zone - VPN Zone). My intention is to find the source of the traffic (the process that is originating it). BR – Ezeq Jul 19 '17 at 12:46
1

Kaspersky Rescue Disk is a tool against malware, not against remote external attacks and in the majority of the cases it would not help here.

The most possible reason this traffic was dropped is that the requests, purposefully or not, were crafted in a way that they could cause a denial-of-service state on your host. In other words, if the systems you use are vulnerable to CVE 2017-0016 ("Microsoft Windows contains a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service on a vulnerable system." - https://www.kb.cert.org/vuls/id/867968), the traffic that was dropped could have caused them to crash and that's why it was dropped.

Things to consider:

  1. Have you applied the critical security update MS17-012? (https://technet.microsoft.com/library/security/ms17-012)

  2. Do you even need SMB? If not, disable this service (close the port 445).

There is also a possibility that this was a false positive and the traffic was genuine and not DoS-inducing. If you suspect this, investigate the traffic and get the firewall rules tweaked accordingly.

  • thanks @aistesk; Yes I do believe that we need SMB, for file sharing and printers. Both computers where updated. – Ezeq Jul 19 '17 at 12:28
  • Question: 1) If it is a false positive, how do I investigate it? The machines are in production and the least time I'm with them the best. 2) I suppose a "remote external attacks" has (by default) a malware running in a machine inside the domain to allow entrance. That was what I was trying to find. Or should I do another reading about " remote external attacks"? – Ezeq Jul 19 '17 at 12:35
  • PS:outbound SMB connections (TCP ports 139 and 445 along with UDP ports 137 and 138) from the local network to the WAN, are block. this is happening in "VPN" zone (client to site connections). – Ezeq Jul 19 '17 at 13:05
0

Answering your comment here since the comment space seems too small.

1) Every environment is different and I, or anyone else, can't tell how exactly should your situation be investigated. But the logs are all you need, you don't need to disturb the machines' work. I would start from looking at all the logs related to these hosts around the times of those DoS alerts (could start with 5 minutes and reduce if the number of log entries is unmanageable) to possibly get some context of the events. For example, was there any other suspicious traffic sent from the same source.

2) Devices, that are connected to the network, are most often available for malicious vulnerability scanning and external attack attempts. They don't need to be infected if malicious actors want to try to attack them. As long as they're patched for the said vulnerabilities though, it is fine.

I'm not sure if I understand your described infrastructure correctly but if the dropped traffic was internal it was most likely false positive. Or someone within your infrastructure tried to DoS your hosts (not impossible).

  • thanks for your prompted response; 1) OK, I will dig the Logs, to see if I find something. 2)After said, it make sense. Good clarification. I don't know if one can tell VPN is In or Out. They are WAN side, but after authentication (SSL) they are in the VPN zone, almost LAN side. – Ezeq Jul 19 '17 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.