Detections
Analytics

46.5 Ensure Enable Mailslots' is set to 'Disabled'

Information

This policy settings controls whether the SMB client will use remote mailslots over Multiple UNC Provider (MUP). The remote mailslots protocol is an old, simple, unreliable, and insecure inter-process communication method.

The recommended state for this setting is: Disabled.

Remote mailslots is a legacy protocol that uses SMBv1 to function. This protocol is linked to known vulnerabilities, such as denial-of-service, buffer overflow, and remote code execution attacks.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled :

Lanman Workstation\Enable Mailslots

Note: A reboot is required after the setting is applied.

Impact:

If the remote mailslots feature was in operation, it will no longer function.

See Also

https://workbench.cisecurity.org/benchmarks/27282

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: cb89d84ce6e87a2ae15ed6b2259e374863b5bc27a6d1882df5a50656dbb39619