Sunday, September 20, 2009

What's with the SMB 2.0 (advisory 975497)?

Microsoft, upon investigation of new public reports of a possible vulnerability in the Server Message Block (SMB) implementation, has released an update (dated 18 September 2009) that includes information on the easy way to disable SMB 2.0, a first exploit for code execution released to small number of companies, ways that help prevent attacks, and the status of fixes. The original advisory 975497, published 12 days ago, warned about vulnerabilities in SMB that could allow remote code execution, which could indeed happen only with Windows Vista and Windows Server 2008, BUT NOT with Windows 7, as it was wrongfully reported (not surprisingly by a "security evangelist" working for an Internet security company. I can't help but wonder, is this just the first time?). SMB 2.0, of which CIFS—Common Internet File System is a "dialect"—is the file sharing protocol used by Windows-based computers and this new version is included in Windows Server 2008 and Vista as part of core networking improvements.

No comments: