Server Message Block (SMB) Protocol Version 1 Unspecified RCE

Nessus Output

Description
The remote Windows host supports Server Message Block (SMB) Protocol version 1. 
It is, therefore, affected by an unspecified remote code execution vulnerability that allows an unauthenticated, 
remote attacker to execute arbitrary code.

Note that this vulnerability is one of multiple Equation Group vulnerabilities and 
exploits disclosed by a group known as the Shadow Brokers.

Solution
Disable SMBv1 according to the vendor instructions in Microsoft KB2696547. 
Additionally, block SMB directly by blocking TCP port 445 on all network boundary devices. 
For SMB over the NetBIOS API, block TCP ports 137 / 139 and UDP ports 137 / 138 on all network boundary devices.

Verify if SMB version 1 is enable

Get-SmbServerConfiguration | Select EnableSMB1Protocol

Fix

Disable version SMB version 1.

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Fix via Group Policy

Create a new group policy preference registry

Nessus Compliance Check

<custom_item>
 type : REGISTRY_SETTING
 description : "SMB version 1 disabled"
 value_type : POLICY_DWORD
 value_data : 0
 reg_key : "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
 reg_item : "SMB1"
 check_type : CHECK_EQUAL
 reg_option : CAN_NOT_BE_NULL
</custom_item>

References