Re: Ransomware Wanna Cry Affecting Windows Server Based UCCE Applications

dtran · ‎06-27-2019

Hello everyone, hope everyone is well and thanks in advance for any inputs / suggestions to my questions !!!

I've got a UCCE 10.5 environment and I've been asked by my network security team to patch a few of my Windows based servers (Roggers, PG's, HDS ...) to resolve the 'Ransomware" concerns.

Has anyone run into this issue and what was your fix/resolution ?

Thanks !!!

Danny

Omar Deen · ‎06-27-2019

Do the servers already have the ransomware on them? If they do... you're best bet is to just re-build one side a time. If you do this fast enough, you can get this all done within 24 hours at most. If there is no ransomware, then UCCE has nothing to do with this... consult with security.

dtran · ‎06-27-2019

Hello Omar, thanks for the response !!!
The servers aren't infected. I am looking into patching the servers to protect them from infected.
This is what I need to patch "MS17-010: Security Update for Microsoft Windows SMB Server" and I believe there is a couple ways to patch
1. Disable SMB v1 on the server
2. Install the patch
I am trying to figure out what patch to install or just disable SMB v1 and what are the side effects to UCCE.
Thanks !!!
Danny

Omar Deen · ‎06-28-2019

The patch for that vulnerability has been out for several years. Also, depending on what version of Windows Server you're running, SMB v1 might be disabled by default. UCCE does not have an SMB v1 dependency, so if it's not already disabled, you can go ahead and disable it.
But your servers should be getting monthly patch management, and there should be hardware appliances on the edge of your network to help combat malignant threats. All you can really do for UCCE and its VOS applications is stay on top of Windows and VOS patching.

Leo Laohoo · ‎06-28-2019

@dtran wrote:

I've got a UCCE 10.5 environment and I've been asked by my network security team to patch a few of my Windows based servers

Patching WannyCry(pt) is the least of your worries. There are a lot of vulnerabilities and exploits out in the wild. FW, IPS/IDS will do their job but servers need to be appropriately and adequately patched.