Select the product you need help with

MS10-020: Vulnerabilities in SMB client could allow remote code execution

Article ID: 980232 - View products that this article applies to.

Support for Windows Vista Service Pack 1 (SP1) ends on July 12, 2011. To continue receiving security updates for Windows, make sure you're running Windows Vista with Service Pack 2 (SP2). For more information, refer to this Microsoft web page: Support is ending for some versions of Windows
(http://windows.microsoft.com/en-us/windows/help/end-support-windows-xp-sp2-windows-vista-without-service-packs)
.

Expand all | Collapse all

INTRODUCTION

Microsoft has released security bulletin MS10-020. To view the complete security bulletin, visit one of the following Microsoft Web sites:

Home users:
http://www.microsoft.com/security/updates/bulletins/201004.aspx
(http://www.microsoft.com/security/updates/bulletins/201004.aspx)
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
http://update.microsoft.com/microsoftupdate
(http://update.microsoft.com/microsoftupdate)
IT professionals:
http://www.microsoft.com/technet/security/bulletin/MS10-020.mspx
(http://www.microsoft.com/technet/security/bulletin/MS10-020.mspx)

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update

(http://support.microsoft.com/ph/6527)

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

(http://technet.microsoft.com/security/bb980617.aspx)

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center

(http://support.microsoft.com/contactus/cu_sc_virsec_master)

Local support according to your country: International Support

(http://support.microsoft.com/common/international.aspx)

Back to the top | Give Feedback

Known issues

Symptoms

After you install this security update on a Windows-based client computer, you may be unable to save documents to folders or to change the permission settings of folders on an SMB 1.0-based remote server.

Cause

As part of this security update, an update was made to the way that SMB validates the security descriptor that the client sends. Some Common Internet Files System (CIFS) server implementations on Windows NT 4-based systems and on network-attached storage (NAS)-based filers set the response to 0 instead of using the actual length of the security descriptor. This behavior results in a validation failure. Because of this failure, you may be unable to save Office files on SMB shares or on Windows NT 4-based, NAS-based, and Ntbackup-based systems. Also, you may receive a misleading error while you are creating a backup from a network share on a Windows NT 4-based system. This is a reporting error only. You can safely ignore this reporting error because the backup and restore will have completed correctly.

Workaround

To work around this problem, save the file that you are trying to back up as a local file, and then copy or move the file to the remote folder or to the remote Windows NT-based share.

Resolution

To resolve this problem, install hotfix 983458. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

983458

(http://support.microsoft.com/kb/983458/ )

You cannot save documents to a folder or change the permission settings of folders on a SMB 1.0-based remote server from a Windows-based computer that has security update 980232 (MS10-020) installed

More information

The problem was reported with specific versions of Cisco WAAS systems and with NetApp DataOnTap systems. Those companies have issued reports. For more information, visit the following web pages.

Cisco Field Notice 63320
http://www.cisco.com/en/US/ts/fn/633/fn63320.html

(http://www.cisco.com/en/US/ts/fn/633/fn63320.html)

NetApp NOW Customer Public Report
http://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=412113

(http://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=412113)

Note You must have a NetApp NOW account to access this report.

Back to the top | Give Feedback

FILE INFORMATION

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.