Vulnerability on UIM Windows Server : R7-cifs-smb-signing-disabled

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Vulnerability got detected on UIM application Servers hence, we need to confirm that its not impacting on our UIM application 

Resolution

This is an operating system-level protocol configuration and remediation should be done by customer administrator.UIM Server/Robot is application software, so nothing can be done from UIM perspective.

 

Protocol Level: SMB (Server Message Block) is managed directly by the Windows kernel.

Global Port: The OS listens on Port 445 and handles all incoming SMB traffic.

Shared Service: Applications rely on the OS to transport files and cannot modify the underlying protocol behaviour.

 

The R7-cifs-smb-signing-disabled vulnerability, often reported by Rapid7 Nexpose/InsightVM, indicates that an SMB server does not require digital signatures for communications. Without these signatures, the system is susceptible to man-in-the-middle (MITM) attacks and SMB relay attacks, allowing attackers to alter traffic, steal credentials, or compromise systems. 

Key Aspects of the Vulnerability:

• What it means: SMB signing is either disabled or enabled but not required.
• The Risk: Unauthenticated attackers can inject commands or redirect traffic, as they can tamper with data during transmission.
• Where it's found: It is common in legacy networks or misconfigured Windows systems (workstations and servers).
• Remediation: Enable "Microsoft network server: Digitally sign communications (always)" in Group Policy or set -is-signing-required to true on file servers.