대상이 Vista, Windows 7, Windows server 2008 이기 때문에 확산력이 크진 않을 듯 하지만,
The Server Message Protocol (SMB) is the file sharing protocol used by default on Windows-based computers. Although file sharing and network protocols are primarily supported by our Networking team, it is important to understand how SMB works given its importance to network activities. SMB 2.0 was introduced in Windows Vista and Windows Server 2008. SMB 1.0 was designed for early Windows network operating systems such as Microsoft LAN Manager and Windows for Workgroups. SMB 2.0 is designed for the needs of the next generation of file servers. Both Windows Server 2008 and Windows Vista support SMB 1.0 and SMB 2.0.
There are several enhancements in SMB 2.0, including:
- Sending multiple SMB commands in the same packet which reduces the number of packets sent between a client and server
- Larger buffer sizes
- Increased scalability, including an increase in the number of concurrent open file handles on the server and the number of shares that a server can share out
- Support for Durable Handles that can withstand short network problems
- Support of Symbolic Links
The version of SMB used for file sharing is determined during the SMB session negotiation. If both the client and server support SMB 2.0, then SMB 2.0 is selected during the initial negotiation. Otherwise SMB 1.0 preserving backwards compatibility. The table below shows the version of SMB that will be used in different client / server scenarios:
Client | Server | SMB Version |
Windows Server 2008 / Vista | Windows Server 2008 / Vista | SMB 2.0 |
Windows Server 2008 / Vista | Windows 2000, XP, 2003 | SMB 1.0 |
Windows 2000, XP, 2003 | Windows Server 2008 / Vista | SMB 1.0 |
Windows 2000, XP, 2003 | Windows 2000, XP, 2003 | SMB 1.0 |
Both SMB 1.0 and 2.0 are enabled by default on Windows Vista and Windows Server 2008. In some testing and troubleshooting scenarios it may be necessary to disable either SMB 1.0 or SMB 2.0. However, it should be noted that this is not a recommended practice. To disable SMB 1.0 for Windows Vista or Windows Server 2008 systems that are the “client” systems (accessing the network resources), run the following commands:
sc config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc config mrxsmb10 start= disabled
To disable SMB 1.0 on a Windows Vista or Windows Server 2008 system that is acting as the “server” system (hosting the network resources), a registry modification is required. Navigate to the HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters key. If there is no REG_DWORD value named Smb1, you will need to create it. This value does not exist by default. Once the value is created, set the value to 0 to disable SMB 1.0 or 1 to enable SMB 1.0.
Finally, to disable SMB 2.0 on Windows Vista or Windows Server 2008 systems that are acting as the “server”, navigate to the registry key listed above. Instead of creating the Smb1 REG_DWORD value, you would create a REG_DWORD value called Smb2. Set the value to 0 to disable SMB 2.0 and 1 to enable SMB 2.0.
'취약점소식' 카테고리의 다른 글
[Adobe]Adobe Acrobat Reader Remote Code Execution Vulnerability (2) | 2009.10.09 |
---|---|
[제로보드] ZeroBoard 4.1pl9 신규 취약점 및 배포⋅서비스 중지에 따른 주의 (0) | 2009.09.22 |
IIS 5.0/6.0 FTP 제로데이 취약점 (0) | 2009.09.01 |
[Adobe]Flash Player or Acrobat Reader 0-day 취약점 (1) | 2009.07.23 |
MS Office Zero-Day 취약점 관련 악성코드 주의 (2) | 2009.07.15 |
댓글