What to do with Microsoft SMB2 vulnerability

By Nick Lewis | Feb 8, 2010

0 comments

Facebook

LinkedIn

Digg

In early September, Microsoft advised users of a remote code execution vulnerability found in its Server Message Block Version 2 (SMBv2) protocol. SMB is a file sharing and printing protocol used in Windows to pass messages between networked devices.

Researchers developed working exploit code that could be used to exploit the flaw and cause a denial of service (DoS) or unauthenticated remote code execution. This exploit code has been publically released as well.

Early on, Microsoft released a fix that disabled SMBv2. SMBv2, an update to the protocol, is only supported on Windows Server 2008, Windows Vista and Windows 7, and can only be used if both the client and server support it. Windows Vista SP2 and prior and Windows 2008 SP2 and prior are vulnerable. Windows 7 Release Candidate is also vulnerable, but was patched prior to Windows 7's official release. Windows XP, Windows 2003 and Windows 2008 R2 are not vulnerable.

In October, the software giant issued a security patch as part of its normal Patch Tuesday cycle. Enterprises were recommended to apply this patch during their normal patching cycle, and if they could not deploy it, they should have done so prior to the next Microsoft patch release. In this tip, let's explore why enterprises should consider expediting SMB patch deployment or using one of the workarounds.

Remote code execution or denial-of-service attacks are serious threats to an environment. The Server Message Block Version 2 security vulnerability could be incorporated into bots, worms or other malicious code to attack an organization, access its data and gain a further foothold into its network. Many bots, worms, or other types of malicious code are developed in a modular fashion to easily incorporate new attack methods and vulnerabilities.

For example, the notorious Conficker worm (or Conficker/Downadup) used several different Windows vulnerabilities to spread and infect systems. Similarly, the SMB vulnerability has the capability to be included in a worm and spread quickly. While the exploit code hasn't yet been included in other malware, it could be incorporated into worms or bots and used in targeted attacks. It also has been included in the Metasploit open source penetration testing framework.

0 comments

Facebook

LinkedIn

Digg