QID 379223

Date Published: 2024-03-01

QID 379223: Windows SMB Version 1 (SMBv1) Detected

The Server Message Block (SMB) Protocol is a network file sharing protocol, and as implemented in Microsoft Windows is known as Microsoft SMB Protocol.

Microsoft publicly deprecated the SMBv1 protocol in 2014. It was superseded by SMBv2 and later protocols

The Windows host has SMBv1 protocol enabled for either :
Client or Server

QID Detection Logic:
Authenticated:
Windows: This QID checks for used SMB version on target and flags if SMBv1 is used.
Unauthenticated:
This QID sends special SMBv1 packets to the target and flags if SMBv1 packets found in response.

SMBv1 protocol is deprecated and vulnerable to many known and unknown vulnerabilities, may allow a remote attacker in complete system compromise.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Microsoft advises users against reinstalling SMBv1 due to its status as an older protocol with well-documented security vulnerabilities, particularly concerning ransomware and other types of malware. Instead, users are strongly encouraged to upgrade to the latest versions of SMB and discontinue the use of SMBv1 for improved security posture and protection against potential threats.
Refer to Microsoft KB article SMB for more details.Workaround:
Customer may consider blocking all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices.

Vendor References

Microsoft SMBv1 Deprecated - learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/smbv1-not-installed-by-default-in-windows

CVEs related to QID 379223

Software Advisories

Advisory ID	Software	Component	Link
Microsoft			learn.microsoft.com/en-US/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3?tabs=server

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].