Connection to SMB server with no password (SMB_Empty_Password_Failed)

About this signature or vulnerability

Proventia Server IPS for Linux technology, RealSecure Desktop Protector 3.6, Proventia Network IPS, Proventia-G 1.1 and earlier, Proventia Desktop, Proventia Network IDS, IBM Security Server Protection for Windows, Proventia Network MFS, BlackICE Agent for Server, BlackICE PC Protection, BlackICE Server Protection, RealSecure Server Sensor, RealSecure Network, Virtual Server Protection for Vmware:

This signature detects when an unsuccessful login attempt with no password is made to an SMB server.

Default risk level

 High

Sensors that have this signature

Proventia Server IPS for Linux technology: 1.0, RealSecure Desktop Protector 3.6: enw, Proventia Network IPS: XPU 1.42, RealSecure Desktop: enw, Proventia-G 1.1 and earlier: XPU 22.35, Proventia Desktop: 8.0.614.1, Proventia Network IDS: XPU 22.35, IBM Security Server Protection for Windows: 2.1.14.2400, IBM Security Server Protection for Windows: 1.0.914.0, Proventia Network MFS: XPU 1.35, BlackICE Agent for Server: 3.6eof, BlackICE PC Protection: 3.6cpa, BlackICE Server Protection: 3.6.cpa, RealSecure Server Sensor: XPU 22.35, RealSecure Network: XPU 22.35, Virtual Server Protection for Vmware: 1.0

Systems affected

Microsoft Windows, Samba Samba, Microsoft Windows 95, Microsoft Windows NT: 4.0, Microsoft Windows 98, Microsoft Windows 98SE, Microsoft Windows 2000, Microsoft Windows Me, Microsoft Windows XP, Microsoft Windows 2003 Server

Type

Suspicious Activity

Vulnerability description

How to remove this vulnerability

References