Check Point Advisories

Brute Force Scanning of CIFS Ports

Vulnerability
Protection

Check Point Reference:	SBP-2011-03
Date Published:	27 Feb 2011
Severity:	Medium
Last Updated:	Sunday 14 January, 2024
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75, R71, R70
Who is Vulnerable?
Vulnerability Description	CIFS is an extension to the Message Block Server (SMB) protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. By trying to repeatedly authenticate to a SMB connected server using different passwords, it is possible to crack user accounts on the remote target or compromise the target. Scanning machines on a network involves the same Brute Force technique - sending a large amount of packets for various protocols, and deducing which services are listening from the responses received. A host port scan is directed at a specific host or network. A scan on CIFS ports can determine which services a host offers. Attackers can then direct their efforts against those services on that machine.

Protection Overview

This protection will detect and block Brute Force scanning of CIFS ports.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75 / R71 / R70

In the IPS tab, click Protections and find the Brute Force Scanning of CIFS Ports protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Windows SMB Protection Violation.
Attack Information: Brute Force Scanning of CIFS Ports