I have read about a new security flaw in Windows Vista and SMBv2. What is it and how does it affect me? What is SMBv2?


The SMBv2 flaw is discussed in this security bulletin from Microsoft. The flaw was thought to allow an attacker to crash any Windows Vista computer(and pre-release versions of Windows 7) over a network. It has since been proven to allow the attacker to take over and install malware onto your PC.

SMBv2 is used to share printers and files between computers. Microsoft has not yet released a patch to fix this vulnerability, they currently recommend disabling this service. You can safely disable this service and use SMBv1 and maintain network sharing, although it may be somewhat slower. Microsoft has released an easy “Fix It” to disable the service for you.

You are vulnerable if you are running these operating systems:

  • Windows Vista, any service pack
  • Windows 7 Beta
  • Windows 7 RC

You are not vulnerable if you are running these operating systems:

Any of the above systems with SMBv2 turned off.

  • Windows XP, any version
  • Windows 7 RTM or Retail

[disclosure: I am original poster, just want this information to get out a bit more]

  • I'm confused. The security bullentin you link to was published in December 2007 which is not exactly new. It also contains links to hotfixes that supposedly fix the vulnerability for Vista and Vista x64 (KB942624). The Fix It link goes to a technet blog post published only a few days ago and mentions a "new" SMBv2 vulnerability, but doesn't link to any associated security bulletin or KB article. – Ryan Bolger Sep 21 '09 at 23:30
  • Whoops, link fixed. – Keck Sep 21 '09 at 23:35

It is worth noting that whilst this does seem like a serious flaw where most people will be affected, the chances of something happening are very low.

If you are behind any sort of router, unless you enable a DMZ / forward all to a ip type policy, it is unlikely that any attack would reach your computer.

The only way to be affected would really be someone on your own network attacking you - I can imagine this possibly being a problem on badly managed hot-spots and schools (I remember winnuke at mine... good times!), but again, it is unlikely that you will be affected.

  • Absolutely. There are still a sizeable number of directly connected internet pc's and laptops floating around. It is worth noting that a firewall/router can block this attack. – Keck Sep 21 '09 at 23:49
  • Even if a machine is directly connected, I don't think since 95/98 that ICS (Internet Connection Sharing) actually shares files/folders/enables SMB on the external connection. If the machine is a solo machine, it is unlikely to have SMB/file sharing even on... Again, not saying it couldn't happen, just saying very unlikely – William Hilsum Sep 22 '09 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.