CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability • Hacker News Board

CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#1

Post by marksamman » Tue, Oct 13, 2020, 5:52 PM UTC

CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability
portal.msrc.microsoft.com

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#2

Post by goalieca » Tue, Oct 13, 2020, 6:43 PM UTC

This is wormable. Ready your patches!

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#3

Post by mrpippy » Tue, Oct 13, 2020, 6:58 PM UTC

Sophos says achieving RCE is extremely difficult: https://news.sophos.com/en-us/2020/10/13/top-reason-to-apply...

I also assume that routers won't pass ICMPv6 RAs, so limited to a single network segment. And, only affects Windows 10.

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#4

Post by NikolaeVarius » Tue, Oct 13, 2020, 7:49 PM UTC

"While Shodan.io shouldn’t be counted on as a definitive source, our best queries put the number of Windows Server 2019 machines with IPv6 addresses is in the hundreds, not exceeding approximately 1000. This is likely because most servers are behind firewalls or hosted by Cloud Service Providers (CSPs) and not reachable directly via Shodan scans."

High priority issue, but I dont think we will see some massive wave of outages.

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#5

Post by jdsnape » Tue, Oct 13, 2020, 7:50 PM UTC

goalieca wrote: post #2

This is wormable. Ready your patches!

I’ve not looked in detail, but I’d be surprised if it was as I don’t think Router Announcements propagate beyond the local network...so you could get all machines on a network segment but it wouldn’t spread across a whole company.

Definitely still worth patching tho!

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#6

Post by goalieca » Tue, Oct 13, 2020, 8:06 PM UTC

jdsnape wrote: post #5

goalieca wrote: post #2

This is wormable. Ready your patches!

I’ve not looked in detail, but I’d be surprised if it was as I don’t think Router Announcements propagate beyond the local network...so you could get all machines on a network segment but it wouldn’t spread across a whole company. Definitely still worth patching tho!

I was thinking along the lines of infected laptop that goes from wifi to wifi. I may be wrong though.

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#7

Post by WalterSobchak » Tue, Oct 13, 2020, 8:09 PM UTC

mrpippy wrote: post #3

Sophos says achieving RCE is extremely difficult: https://news.sophos.com/en-us/2020/10/13/top-reason-to-apply... I also assume that routers won't pass ICMPv6 RAs, so limited to a single network segment. And, only affects Windows 10.

It's not just Windows 10.

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#8

Post by blincoln » Tue, Oct 13, 2020, 8:35 PM UTC

NikolaeVarius wrote: post #4

"While Shodan.io shouldn’t be counted on as a definitive source, our best queries put the number of Windows Server 2019 machines with IPv6 addresses is in the hundreds, not exceeding approximately 1000. This is likely because most servers are behind firewalls or hosted by Cloud Service Providers (CSPs) and not reachable directly via Shodan scans." High priority issue, but I dont think we will see some massive wave of…

Shodan (or anyone else) can't really get an authoritative count of live IPv6 devices of any kind, because the address space is too big to scan using brute force.

They had (have?) a clever semi-workaround for this, by getting themselves into one or more of the public NTP pools, and then port-scanning any IPv6 address that queried their NTP service, but I wouldn't consider that count anything like definitive.

Regardless, it's still a huge problem for internal networks.

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#9

Post by ingomaro » Tue, Oct 13, 2020, 8:37 PM UTC

mrpippy wrote: post #3

Sophos says achieving RCE is extremely difficult: https://news.sophos.com/en-us/2020/10/13/top-reason-to-apply... I also assume that routers won't pass ICMPv6 RAs, so limited to a single network segment. And, only affects Windows 10.

Microsofts own CVSS score says 'attack complexity' is low.

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=...

Re: CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability

#10

Post by mrpippy » Tue, Oct 13, 2020, 9:36 PM UTC

WalterSobchak wrote: post #7

mrpippy wrote: post #3

Sophos says achieving RCE is extremely difficult: https://news.sophos.com/en-us/2020/10/13/top-reason-to-apply... I also assume that routers won't pass ICMPv6 RAs, so limited to a single network segment. And, only affects Windows 10.

It's not just Windows 10.

There aren't any Windows versions before W10 1709 (or Windows Server before 2019) listed in the release.