Product:
Windows
Summary
The SMBv1 server in various Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. This vulnerability is known as Windows SMB Remote Code Execution Vulnerability. It affects multiple versions including Windows Vista, Windows 7, Windows 8.1, and Windows 10.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2017-0145 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted packets to the SMBv1 server, which can lead to remote code execution. The attacker does not need to authenticate, making it easier to exploit. Successful exploitation can result in complete control over the affected system.
Affected Products
- Windows Vista SP2
- Windows Server 2008 SP2 and R2 SP1
- Windows 7 SP1
- Windows 8.1
- Windows Server 2012 Gold and R2
- Windows RT 8.1
- Windows 10 Gold, 1511, and 1607
- Windows Server 2016
Mitigation
To mitigate this vulnerability, it is essential to apply updates as per the vendor’s instructions. Disabling SMBv1 can also help reduce the risk of exploitation.
References
- DOUBLEPULSAR Payload Execution Neutralization
- SMB DOUBLEPULSAR Remote Code Execution
- SecurityFocus BID 96705
- SecurityTracker ID 1037991
- Siemens Product Cert SSA-701903
- Siemens Product Cert SSA-966341
- ICS-CERT Advisory ICSMA-18-058-02
- Microsoft Security Advisory CVE-2017-0145
- Exploit DB 41891
- Exploit DB 41987
- CISA Known Exploited Vulnerabilities Catalog