Article

Microsoft releases temporary fix for SMB2 zero-day vulnerability

Robert Westervelt, News Director

    Requires Free Membership to View

SearchSecurity.com:
To get security news and tips delivered to your inbox, click here to sign up for our free newsletter.

Microsoft updated a security advisory releasing an automated fix that temporarily disables the Server Message Block (SMB) until a patch is released correcting a zero-day vulnerability in SMB2 on Windows Vista and Server 2008 operating systems.

Exploit code targeting the flaws was released to customers of penetration testing firm Immunity Inc. Initial proof of concept code, which is widely available resulted in a system crash, but a subsequent update to the code enables an attacker to gain access and take full control of a computer.

Microsoft issued a security advisory Sept. 8, warning that the code had surfaced and was targeting certain SMB implementations. The SMB is used in Windows to communicate messages to devices on the network and for file sharing and communicating with printers.

The fix-it code was released late last week and automatically disables SMB. It applies to Windows Server 2008 Service Pack 2, Windows Vista Service Pack 2 and Windows Vista Service Pack 1. A manual workaround is also available. An IT professional can use registry editor to disable certain registry keys. But Microsoft warns that using the editor incorrectly could cause serious problems that may require a complete reinstall of the operating system. Disabling SMB2 may slow down traffic between Windows Vista and Windows Server 2008 machines, Microsoft said.

In a blog entry, Microsoft Security Response Center engineers Mark Wodrich and Jonathan Ness said they are not aware of any in-the-wild exploits or real-world attacks.

"The product team has built packages and are hard at work testing now to ensure quality," the researchers wrote. "For this update, the product team has so far already completed over 10,000 separate test cases in their regression testing. They are now in stress testing, third-party application testing and fuzzing."


There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: