SMB2 Server Denial of Service

Question

Hi,
My firewall has detected the "SMB2 Server Denial of Service" on
one of our domain controller servers based on windows server 2008R2. Is there any workaround or updates/patches that could help me prevent these attacks?
https://technet.microsoft.com/en-us/library/security/ms11-048.aspx
The above MSU is already installed even then the attack has been reported. Please let me know if there is anything else that i need to do to stop/mitigate these attacks.
Thanks
Farhan Umer

Answer 1

Hi,
Generally, the vulnerability is caused when the Microsoft Server Message Block (SMB) Protocol software improperly handles specially crafted SMB requests. Totally i suggest you follow one of the instruction to apply one of this tools.
http://support.microsoft.com/kb/961747
Windows Update
Microsoft Update
The Microsoft Baseline Security Analyzer (MBSA)
Windows Server Update Services (WSUS)
Microsoft System Center Configuration Manager 2007 (Configuration Manager 2007)
Microsoft Systems Management Server (SMS) 2003
The Extended Security Update Inventory Tool
Moreover, would you like to verify if there are any the 3rd party applications exploited this vulnerability influencing the SMB request?
Actually, the impaction of the denial services could cause a user's system to stop responding until manually restarted. Since that, we can find something stopping responding and is there any real impact on your current system?
If the above methods make no sense, it is recommended that you run the network monitor or process monitor to marrow this issue. Any other symptoms would be appreciated.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.