Hello everyone,
a serious new 9.8 vulnerability has been discovered in the TCp IPV6 protocol
Microsoft explained in its official communication that attackers can exploit the bug remotely by repeatedly sending specially prepared IPv6 packets. The problem is characterised by low exploitation complexity, which increases the likelihood of its use in attacks. The company noted that similar vulnerabilities have been attacked in the past, which makes this bug particularly attractive to attackers.
it is strongly recommended to patch or disable IPV6 On cloud platforms (Azure,AWS,GCP) servers expose public IPs.
CVE-2024-38063 is a zero-click vulnerability that utilizes specially crafted packets to trigger a buffer overflow vulnerability that can be used to execute arbitrary code on vulnerable systems
The vulnerability can be mitigated by turning off IPv6 on vulnerable machines or blocking incoming IPv6 traffic in the firewall. Businesses should consider implementing one of these measures until vulnerable machines are patched. Servers accessible from the Internet should be given priority. Microsoft has already released a patch to fix this problem, released on August 13, 2024
August 13, 2024—KB5041160 (OS Build 20348.2655) - Microsoft Support
The company pointed out that the vulnerability has ‘wormable’ status, which means it can spread between systems without user interaction, similar to computer worms. Trend Micro also pointed out that IPv6 is enabled by default on almost all devices, which makes it difficult to prevent attacks.
NVD - CVE-2024-38063 (nist.gov)
For those who cannot install the patch immediately,The workaround is to disable IPv6.
However,MS warns that disabling IPv6 may cause some Windows components to malfunction, as the protocol is a mandatory part of the operating system.
Configure IPv6 for advanced users - Windows Server | Microsoft Learn
DOS
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ /v DisabledComponents /t REG_DWORD /d 0xFF /f
Powershell
Get-NetAdapterBinding | Where-Object ComponentID -EQ 'ms_tcpip6'
Disable-NetAdapterBinding -Name 'Ethernet' -ComponentID 'ms_tcpip6'
Regrads
