CVE-2017-0143
Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
Description
CVE-2017-0143 is a HIGH remote code execution vulnerability affecting Microsoft Windows SMBv1 Server, carrying a CVSS 3.1 score of 8.8. The SMBv1 server in multiple versions of Microsoft Windows allows remote attackers to execute arbitrary code via specially crafted packets sent to the SMB service. This vulnerability is part of the EternalBlue family of exploits and is closely related to CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148. Affected products include Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2, Windows RT 8.1, Windows 10 (multiple versions), and Windows Server 2016. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.93987 (99.89th percentile), this vulnerability demonstrates extremely high real-world exploitation activity. This vulnerability has known ransomware associations, notably including the WannaCry and NotPetya campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | server message block | 1.0 |
| philips | intellispace portal | 7.0; 8.0 |
| siemens | acuson p300 firmware | 13.02; 13.03; 13.20; 13.21 |
| siemens | acuson p500 firmware | va10; vb10 |
| siemens | acuson sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | acuson x700 firmware | 1.0; 1.1 |
| siemens | syngo sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | tissue preparation system firmware | All versions |
| siemens | versant kpcr molecular system firmware | All versions |
| siemens | versant kpcr sample prep firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/96703(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037991(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf(Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41891/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41987/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43970/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0143(US Government Resource)
Weakness Type
CWE-NVD-noinfo: Insufficient Information
CVE-2017-0143 has no specific CWE classification assigned by NVD. The vulnerability resides in the SMBv1 protocol handling within the Windows kernel, where improper validation of crafted SMB transaction requests leads to a buffer overflow condition. This type of flaw is characteristic of memory corruption vulnerabilities (typically CWE-119 or CWE-120) where input data exceeds the bounds of allocated memory buffers, enabling an attacker to overwrite adjacent memory and redirect program execution flow.
The absence of a specific CWE assignment does not diminish the severity. The underlying weakness in SMBv1 protocol parsing has proven to be one of the most consequential software vulnerabilities in modern computing history, enabling the devastating WannaCry and NotPetya campaigns that caused billions of dollars in damage worldwide.
Impact Analysis
CVE-2017-0143 carries a CVSS 3.1 score of 8.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker kernel-level access to the targeted Windows system, exposing all data stored on or accessible from the compromised machine, including credentials, documents, and network configuration data.
Integrity (HIGH): With kernel-level code execution, attackers can modify system files, install rootkits and backdoors, alter registry settings, and deploy additional malicious payloads including ransomware.
Availability (HIGH): Complete system compromise is possible. The WannaCry ransomware demonstrated the devastating availability impact by encrypting files across hundreds of thousands of systems globally, rendering them completely inoperable.
Scope Unchanged: While the CVSS scope is classified as Unchanged, the wormable nature of this vulnerability means that a single successful exploitation can rapidly propagate across entire network segments, multiplying the effective impact far beyond the initially compromised host.
With an EPSS score of 0.93987 (99.89th percentile) and confirmed ransomware associations, this vulnerability represents one of the most critical risks for any environment still running SMBv1.
Exploit Maturity
CVE-2017-0143 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is part of the EternalBlue family of exploits, originally developed by the NSA and leaked by the Shadow Brokers group in April 2017. Multiple weaponized exploits exist in public exploit databases, Metasploit, and other offensive frameworks. The exploit code is mature, reliable, and widely available.
Ransomware association: This vulnerability has confirmed, extensive ransomware associations. It was the primary propagation mechanism for the WannaCry ransomware outbreak in May 2017, which affected over 200,000 systems across 150 countries. It was also leveraged by the NotPetya destructive malware campaign. Multiple ransomware families continue to target unpatched SMBv1 systems.
Attack surface: SMB (port 445) is commonly exposed on internal networks and sometimes on the internet. The vulnerability is wormable, meaning it can self-propagate without user interaction. Exploitation requires no authentication and can be performed remotely over the network.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Given the catastrophic real-world impact demonstrated by WannaCry and NotPetya, all organizations should have remediated this vulnerability long ago.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Install the March 2017 Microsoft security update MS17-010 from the Microsoft Security Advisory for all affected Windows versions.
- Disable SMBv1 across your environment. SMBv1 is a deprecated protocol with known security weaknesses. Disable it on all systems where it is not absolutely required. Microsoft provides guidance for disabling SMBv1 via Group Policy, PowerShell, or registry settings.
- Block SMB at network boundaries. Block TCP port 445 and related SMB ports (137-139) at firewall and network perimeter boundaries to prevent external exploitation. Implement internal network segmentation to limit lateral movement.
- Verify affected product versions in your environment. Identify all Windows systems running SMBv1 using network scanning and asset inventory tools. Pay special attention to legacy systems that may not have received the MS17-010 patch.
- Scan for signs of prior exploitation. Given the extensive exploitation history, review systems for indicators of compromise associated with EternalBlue, WannaCry, NotPetya, and related malware families. Check for unusual SMB traffic patterns and signs of lateral movement.
- Implement network-level detection. Deploy IDS/IPS signatures for EternalBlue exploitation attempts. Monitor for anomalous SMB traffic patterns that may indicate scanning or exploitation activity.
Technical Details
CVE-2017-0143 is a HIGH-severity vulnerability in the Microsoft Windows SMBv1 server that can be exploited remotely over the network. The attack complexity is low, and no prior authentication or user interaction is required for exploitation.
Technical mechanism: The SMBv1 server in Microsoft Windows fails to properly handle certain crafted SMB transaction requests. An attacker can send specially constructed packets to the SMB service (port 445) that trigger a buffer overflow in kernel memory. This allows the attacker to overwrite critical kernel data structures and achieve arbitrary code execution at the SYSTEM privilege level. The vulnerability is wormable, enabling automated propagation across networks without human intervention.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects an Attack Vector of NETWORK, Attack Complexity of LOW, Privileges Required of LOW, User Interaction of NONE, Scope UNCHANGED, and impact ratings of HIGH across Confidentiality, Integrity, and Availability. The wormable nature of the exploit means the effective real-world impact significantly exceeds what the CVSS score alone conveys.
Frequently Asked Questions
Is CVE-2017-0143 being actively exploited?
Yes, CVE-2017-0143 is one of the most extensively exploited vulnerabilities in history. It is part of the EternalBlue exploit family and was the primary propagation mechanism for the WannaCry ransomware outbreak in May 2017. It continues to be scanned for and exploited by multiple threat actors. The EPSS score of 0.93987 (99.89th percentile) confirms extremely high exploitation activity.
Which products are affected by CVE-2017-0143?
Affected products include Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016. Any Windows system with SMBv1 enabled and missing the MS17-010 patch is vulnerable.
How do I fix CVE-2017-0143?
Apply the MS17-010 security update from Microsoft for all affected systems. Additionally, disable SMBv1 across your environment as it is a deprecated protocol. Block SMB ports (445, 137-139) at network boundaries and implement network segmentation to limit lateral movement potential.
How severe is CVE-2017-0143?
CVE-2017-0143 is rated HIGH with a CVSS 3.1 score of 8.8. However, its real-world severity far exceeds this rating. It enabled the WannaCry ransomware attack that affected over 200,000 systems in 150 countries and the NotPetya attack that caused over $10 billion in damages. It has confirmed ransomware associations and remains actively targeted.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.