MS08-068: Vulnerability in SMB could allow remote code execution

View products that this article applies to.

INTRODUCTION

Microsoft has released security bulletin MS08-068. To view the complete security bulletin, visit one of the following Microsoft Web sites:

Home users:
http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx)
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate/)
IT professionals:
http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx)

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

http://support.microsoft.com/common/international.aspx?rdpath=4 (http://support.microsoft.com/common/international.aspx?rdpath=4)

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

http://support.microsoft.com/oas/default.aspx?&prid=7552 (http://support.microsoft.com/oas/default.aspx?&prid=7552)

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

Known issues with this security update

Symptoms

After you apply this security update, applications such as Microsoft SQL Server or Internet Information Services (IIS) may fail when they make local NTLM authentication requests.

Cause

This problem occurs because of the way that NT LAN Manager (NTLM) treats different naming conventions as remote entities instead of as local entities. A local authentication failure might occur when the client calculates and caches the correct response to the NTLM challenge that is sent by the server in local "lsass" memory before the response is sent back to the server. When the server code for NTLM finds the received response in the local "lsass" cache, the code does not honor the authentication request and treats it as a replay attack. This behavior leads to a local authentication failure.

Resolution

To resolve this problem, you must disable reflection protection so that the affected systems can be authenticated. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

896861 (http://support.microsoft.com/kb/896861/ ) You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6

887993 (http://support.microsoft.com/kb/887993/ ) Users experience authentication issues when they access a Web page in IIS 6.0 or query Microsoft SQL Server 2000 after you install Windows Server 2003 Service Pack 1

926642 (http://support.microsoft.com/kb/926642/ ) Error message when you try to access a server locally by using its FQDN or its CNAME alias after you install Windows Server 2003 Service Pack 1: "Access denied" or "No network provider accepted the given network path"

How to disable NTLM reflection protection

Important This section, method, or task contains steps that tell you how to change the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

To disable NTLM reflection protection, you must modify a registry key on the client computer. To do this, follow these steps on the client computer:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
On the Edit menu, point to New, and then click DWORD Value.
Type DisableLoopbackCheck for the name of the DWORD, and then press ENTER.
Right-click DisableLoopbackCheck, and then click Modify.
In the Value data box, type 1, and then click OK.
Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection

Because the NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system by setting DisableLoopbackCheck to 1 returns the system to a vulnerable state. Therefore, we strongly recommend that you use the BackConnectionHostNames registry key if needed.

How to re-enable NTLM reflection protection

To re-enable NTLM reflection protection, you must modify a registry entry on the client computer. To do this, follow these steps on the client computer:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Right-click DisableLoopbackCheck, and then click Modify.
In the Value data box, type 0, and then click OK.
Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

How to disable NTLM reflection protection for a particular SPN

You can disable NTLM reflection protection for a particular Service Principal Name (SPN) that is causing the corresponding authentication to break. To do this, follow these steps on the client computer:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
On the Edit menu, point to New, and then click Multi-String Value.
Type BackConnectionHostNames for the name of the Multi-String Value, and then press ENTER.

Note If the BackConnectionHostNames registry entry exists as a REG_DWORD, you must delete the BackConnectionHostNames registry entry.
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, type the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

Note You must type each host name on a separate line.
Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection for a particular SPN

Because NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system will return the system to a vulnerable state for the particular SPN for which the reflection protection was disabled.

How to re-enable NTLM reflection protection for a particular SPN

To do this, follow these steps on the client computer:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, delete the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

Note You must type each host name on a separate line.
Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

Back to the top

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.