|Check Point Reference:||SBP-2011-03|
|Date Published:||27 Feb 2011|
|Last Updated:||26 Oct 2016|
|Protection Provided by:||
|Who is Vulnerable?|
|Vulnerability Description||CIFS is an extension to the Message Block Server (SMB) protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. By trying to repeatedly authenticate to a SMB connected server using different passwords, it is possible to crack user accounts on the remote target or compromise the target.Scanning machines on a network involves the same Brute Force technique - sending a large emount of packets for various protocols, and deducing which services are listening from the responses received.A host port scan is directed at a specific host or network. A scan on CIFS ports can determine which services a host offers. Attackers can then direct their efforts against those services on that machine.|
This protection will detect and block Brute Force scanning of CIFS ports.
In order for the protection to be activated, update your Security Gateway product to the latest IPS update.For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.
This protection's log will contain the following information:
Attack Name: Windows SMB Protection Violation.
Attack Information: Brute Force scanning of CIFS ports