Product:
Windows
Summary
The SMBv1 server in various Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. This vulnerability is known as Windows SMB Remote Code Execution Vulnerability. It affects multiple versions including Windows Vista, Windows 7, Windows 8.1, and Windows 10.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2017-0144 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted packets to the SMBv1 server, which can lead to remote code execution. The attacker does not need to authenticate, making it easier to exploit. Successful exploitation can result in complete control over the affected system.
Affected Products
- Windows Vista SP2: Affected by the SMBv1 vulnerability allowing remote code execution.
- Windows Server 2008 SP2: Vulnerable to crafted packet attacks via SMBv1.
- Windows 7 SP1: Can be exploited through the SMBv1 server.
- Windows 8.1: Susceptible to remote code execution via crafted packets.
- Windows Server 2012: Vulnerable to the same SMBv1 exploit.
- Windows 10: Multiple versions including Gold, 1511, and 1607 are affected.
- Windows Server 2016: Also vulnerable to this SMBv1 issue.
Mitigation
To mitigate this vulnerability, it is essential to apply updates as per the vendor’s instructions. Disabling SMBv1 can also help reduce the risk of exploitation.
References
- DOUBLEPULSAR Payload Execution Neutralization
- SMB DOUBLEPULSAR Remote Code Execution
- SecurityFocus BID 96704
- SecurityTracker ID 1037991
- Siemens Product Cert SSA-701903
- Siemens Product Cert SSA-966341
- ICS-CERT Advisory ICSMA-18-058-02
- Microsoft Security Advisory CVE-2017-0144
- Exploit DB 41891
- Exploit DB 41987
- Exploit DB 42030
- Exploit DB 42031
- CISA Known Exploited Vulnerabilities Catalog