This vulnerability affects SMB 2, which is resident in Windows Vista and 2008 Server.  Although SMB 2 is not enabled by default, many systems are expected to have it enabled to allow file sharing.  Therefore, it is expected that the use of SMB 2 on these platforms would be fairly widespread.

When this vulnerability was announced (originally as a Denial of Service), the discoverer also published proof-of-concept code that easily and reliably produced a denial of service (BSOD or Blue Screen of Death).

At the time of initial publication, a proof-of-concept (PoC) exploit proving remote code execution was not publicly available.  However, our independent research (and the private research of others) had proven that remote code execution was indeed possible, making this vulnerability much more severe than originally anticipated.  On Sept. 28, 2009, a working remote code execution PoC was publicly released.

There are a few mitigating factors for this vulnerability.  SMB is not typically available through the firewall, so attacks may be limited to those on unprotected networks or inside the firewall.  Also, customers that do not allow widespread use of file sharing through SMB 2 or who are not using the vulnerable operating systems, are not impacted.

Customers running vulnerable operating systems that require file sharing should deploy protection immediately and apply patches once they are made available.