SEP coverage for CVE-2020-0796

[ins007]

Hi All,

Any idea on the coverage details, can see new Liveupdate per below

OS Attack: Microsoft Server Message Block RCE CVE-2020-0796

https://www.broadcom.com/support/security-center/securityupdates/detail?fid=sep&pvid=sep14&year=2020&suid=CIDS_Enterprise_SEP_14-SU817-20200311.061




Thanks

[John Owens]

Currently, IPS signatures only. The attack method does not lend itself to generic exploit AV signatures, though research will continue

• Sig ID 32098 (OS Attack: Microsoft Server Message Block RCE CVE-2020-0796) - blocking signature released in SU 817 - 20200311.061
• Sig ID 32099 (Audit: Microsoft Compressed SMB Packet) - audit signature released in SU 817 - 20200311.061

There are no reports indicating that this vulnerability is being exploited in the wild.

I believe MS released a patch for this yesterday as well.

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------