Am I affected by the Windows Vista SMBv2 Flaw?

Question

I have read about a new security flaw in Windows Vista and SMBv2. What is it and how does it affect me? What is SMBv2?

Answer 1

The SMBv2 flaw is discussed in this security bulletin from Microsoft. The flaw was thought to allow an attacker to crash any Windows Vista computer(and pre-release versions of Windows 7) over a network. It has since been proven to allow the attacker to take over and install malware onto your PC.

SMBv2 is used to share printers and files between computers. Microsoft has not yet released a patch to fix this vulnerability, they currently recommend disabling this service. You can safely disable this service and use SMBv1 and maintain network sharing, although it may be somewhat slower. Microsoft has released an easy “Fix It” to disable the service for you.

You are vulnerable if you are running these operating systems:

• Windows Vista, any service pack
• Windows 7 Beta
• Windows 7 RC

You are not vulnerable if you are running these operating systems:

Any of the above systems with SMBv2 turned off.

• Windows XP, any version
• Windows 7 RTM or Retail

[disclosure: I am original poster, just want this information to get out a bit more]

Answer 2

It is worth noting that whilst this does seem like a serious flaw where most people will be affected, the chances of something happening are very low.

If you are behind any sort of router, unless you enable a DMZ / forward all to a ip type policy, it is unlikely that any attack would reach your computer.

The only way to be affected would really be someone on your own network attacking you - I can imagine this possibly being a problem on badly managed hot-spots and schools (I remember winnuke at mine... good times!), but again, it is unlikely that you will be affected.