Junglewise Threat Intelligence

CVE-2017-0145: Microsoft SMBv1 Remote Code Execution Vulnerability

CVE-2017-0145 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-02-10

Technologies: Microsoft Windows 10, Microsoft Windows Server 2008, Microsoft Windows Vista, Microsoft Windows 8.1, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows 7, Microsoft Windows Rt 8.1. Vendors: Microsoft.

Executive brief

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. This vulnerability is part of the set of SMB flaws famously exploited by tools like DOUBLEPULSAR.

Affected products

  • Microsoft Windows Vista SP2
  • Microsoft Windows Server 2008 SP2, R2 SP1
  • Microsoft Windows 7 SP1
  • Microsoft Windows 8.1
  • Microsoft Windows Server 2012 Gold, R2
  • Microsoft Windows RT 8.1
  • Microsoft Windows 10 Gold, 1511, 1607
  • Microsoft Windows Server 2016

Timeline

  • 2017-03-14: patched: Microsoft released security updates (MS17-010) to address this vulnerability.
  • 2022-02-10: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.
  • 2022-02-10: disclosed

Related threats