Server Message Block (SMB) Protocol Version 1 Enabled (uncredentialed check)
info Nessus Plugin ID 96982
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Windows host supports the SMBv1 protocol.Description
The remote Windows host supports Server Message Block Protocol version 1 (SMBv1). Microsoft recommends that users discontinue the use of SMBv1 due to the lack of security features that were included in later SMB versions. Additionally, the Shadow Brokers group reportedly has an exploit that affects SMB; however, it is unknown if the exploit affects SMBv1 or another version. In response to this, US-CERT recommends that users disable SMBv1 per SMB best practices to mitigate these potential issues.Solution
Disable SMBv1 according to the vendor instructions in Microsoft KB2696547. Additionally, block SMB directly by blocking TCP port 445 on all network boundary devices. For SMB over the NetBIOS API, block TCP ports 137 / 139 and UDP ports 137 / 138 on all network boundary devices.See Also
https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
http://www.nessus.org/u?8dcab5e4
Plugin Details
Severity: Info
ID: 96982
File Name: smb_v1_enabled_remote.nasl
Version: 1.7
Type: remote
Family: Misc.
Published: 2/3/2017
Updated: 9/22/2020
Dependencies: smb_nativelanman.nasl
Vulnerability Information
Required KB Items: SMB/SMBv1_is_supported
Reference Information
IAVT: 0001-T-0710