Check Point Advisories

SMB Remote Disk Scanning for Executable Files

Vulnerability
Protection

Check Point Reference:	SBP-2010-20
Date Published:	28 May 2010
Severity:	N/A
Last Updated:	Thursday 19 May, 2016
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70, R65
Who is Vulnerable?
Vulnerability Description	Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network access to intrude upon organizations, destroying or stealing data. Some viruses, such as Virus: Win32.Pate.A, send SMB requests for list of executable files on SMB shared disk in order to infect the files consequently. There are cases in which certain traffic, although not intended for malicious use, is very unsafe, since it may transfer shellcode which is undetectable by IPS.

Protection Overview

This protection will detect and block aggressive attempts to retrieve the list of executable files on remote SMB drives.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75 / R71 / R70 / R65

In the IPS tab, click Protections and find the SMB Remote Disk Scanning for Executable Files protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Malware Traffic.
Attack Information: SMB remote disk scanning for executable files