Quais atualizações em particular consertam o WannaCry habilitando a “falha” do SMB?

Navegue suas respostas
6

Quando o WannaCry entrou alguns dias atrás, era compreensível que muitos computadores não tivessem o "defeito" do SMB corrigido, devido a muitas pessoas serem desencorajadas devido às práticas da MS de empurrar telemetria (ou talvez chamá-lo de spyware?) e nagging ou até mesmo atualizações automáticas para W10 através do sistema de atualização.

Por isso, acho que será útil apontar quais atualizações em particular corrigem, para que as pessoas possam instalá-las seletivamente.

Isso inclui as atualizações de 14 de março de 2017, lançadas exatamente no mesmo dia exatamente um mês antes de a exploração EternalBlue se tornar conhecida do público, e as atualizações publicadas após o mês de maio 12 WannaCry ransomware epidemia.

    
por dtech 14.05.2017 / 11:01

1 resposta

11

Quais atualizações específicas corrigem a "falha" do SMB?

Isso foi totalmente documentado pela Microsoft.

MS17-010: Atualização de segurança para o Windows SMB Server: 14 de março de 2017

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.

To learn more about the vulnerability, see Microsoft Security Bulletin MS17-010.

The following articles contain more information about this security update as it relates to individual product versions. These articles may contain known issue information.

  • 4012598 MS17-010: Description of the security update for Windows SMB Server: March 14, 2017
  • 4012216 March 2017 Security Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2
  • 4012213 March 2017 Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2
  • 4012217 March 2017 Security Monthly Quality Rollup for Windows Server 2012
  • 4012214 March 2017 Security Only Quality Update for Windows Server 2012
  • 4012215 March 2017 Security Monthly Quality Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1
  • 4012212 March 2017 Security Only Quality Update for Windows 7 SP1 and Windows Server 2008 R2 SP1
  • 4013429 March 13, 2017—KB4013429 (OS Build 933)
  • 4012606 March 14, 2017—KB4012606 (OS Build 17312)
  • 4013198 March 14, 2017—KB4013198 (OS Build 830)

Fonte MS17-010: Atualização de segurança para o Windows SMB Server: 14 de março de 2017

Notas:

  1. A Microsoft lançou patches para versões não suportadas do Windows:

  2. A Microsoft lançou atualizações para o Windows Defender para detectar a ameaça.

    • A atualização do software antimalware e antispyware da Microsoft contém instruções para atualizar manualmente as definições se você não tem a atualização automática ativada para o Windows Defender.

Orientação ao cliente para ataques WannaCrypt

Today many of our customers around the world and the critical systems they depend on were victims of malicious “WannaCrypt” software. Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful. Microsoft worked throughout the day to ensure we understood the attack and were taking all possible actions to protect our customers. This blog spells out the steps every individual and business should take to stay protected. Additionally, we are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003. Customers running Windows 10 were not targeted by the attack today.

Details are below.

  • In March, we released a security update which addresses the vulnerability that these attacks are exploiting. Those who have Windows Update enabled are protected against attacks on this vulnerability. For those organizations who have not yet applied the security update, we suggest you immediately deploy Microsoft Security Bulletin MS17-010.
  • For customers using Windows Defender, we released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt. As an additional “defense-in-depth” measure, keep up-to-date anti-malware software installed on your machines. Customers running anti-malware software from any number of security companies can confirm with their provider, that they are protected.
  • This attack type may evolve over time, so any additional defense-in-depth strategies will provide additional protections. (For example, to further protect against SMBv1 attacks, customers should consider blocking legacy protocols on their networks).

We also know that some of our customers are running versions of Windows that no longer receive mainstream support. That means those customers will not have received the above mentioned Security Update released in March. Given the potential impact to customers and their businesses, we made the decision to make the Security Update for platforms in custom support only, Windows XP, Windows 8, and Windows Server 2003, broadly available for download (see links below).

Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible.

Fonte Orientação do cliente para ataques WannaCrypt

Leitura Adicional

por 14.05.2017 / 11:27

Tags

Editar rapidamente / alterar o arquivo hosts no Windows Alterar o plano de fundo do OS X Dock