Junglewise Threat Intelligence

CVE-2017-0143: Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability

CVE-2017-0143 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2021-11-03

Technologies: Microsoft Windows 10, Microsoft Windows Server 2008, Microsoft Windows Vista, Microsoft Windows 8.1, Microsoft Windows, Microsoft Windows Server 2016, Microsoft Windows Server 2012, Microsoft Windows 7, Microsoft Windows Rt 8.1. Vendors: Microsoft.

Executive brief

The SMBv1 server in multiple versions of Microsoft Windows allows remote attackers to execute arbitrary code via specially crafted packets. This vulnerability was notably exploited in the wild and is associated with the DOUBLEPULSAR payload.

Affected products

  • Microsoft Windows Vista SP2
  • Microsoft Windows Server 2008 SP2, R2 SP1
  • Microsoft Windows 7 SP1
  • Microsoft Windows 8.1 -
  • Microsoft Windows Server 2012 Gold, R2
  • Microsoft Windows RT 8.1 -
  • Microsoft Windows 10 Gold, 1511, 1607
  • Microsoft Windows Server 2016 -

Timeline

  • 2021-11-03: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.
  • 2021-11-03: disclosed

Related threats