CVE-2017-0147
Microsoft Windows SMBv1 Information Disclosure Vulnerability
Description
CVE-2017-0147 is an information disclosure vulnerability in the Microsoft SMBv1 (Server Message Block version 1) server component present in multiple versions of Microsoft Windows. The flaw allows remote attackers to obtain sensitive information from process memory by sending specially crafted packets to the SMBv1 service. This vulnerability is part of a family of SMBv1 weaknesses that were exploited as part of the EternalBlue and related exploit chains leaked by the Shadow Brokers group. CVE-2017-0147 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with confirmed ransomware associations, and its EPSS percentile of 99.7% indicates near-certain exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows vista | - |
| siemens | acuson p300 firmware | 13.02; 13.03; 13.20; 13.21 |
| siemens | acuson p500 firmware | va10; vb10 |
| siemens | acuson sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | acuson x700 firmware | 1.0; 1.1 |
| siemens | syngo sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | tissue preparation system firmware | All versions |
| siemens | versant kpcr molecular system firmware | All versions |
| siemens | versant kpcr sample prep firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/96709(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037991(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf(Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41891/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41987/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43970/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0147(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes situations where a product exposes sensitive information to actors who are not explicitly authorized to have access to that data. In the case of CVE-2017-0147, the Microsoft SMBv1 server improperly handles certain crafted packets, causing it to leak contents of process memory to a remote attacker. This allows extraction of sensitive data such as memory layout information, credentials, or encryption keys from the target system.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2017-0147 is remotely exploitable without physical access, as the SMBv1 service is network-accessible on port 445. The vulnerability requires no authentication and no user interaction, making exploitation straightforward for any attacker who can reach the SMBv1 service. While the primary impact is on confidentiality through information disclosure from process memory, the leaked data can serve as a critical stepping stone for more severe attacks, including full remote code execution when chained with related SMBv1 vulnerabilities such as CVE-2017-0144 (EternalBlue). The EPSS percentile of 99.7% confirms near-certain active exploitation, and CISA has flagged this vulnerability with a known ransomware association, notably through WannaCry and NotPetya campaigns that caused billions of dollars in damages worldwide.
Exploit Maturity
CVE-2017-0147 has been extensively exploited in the wild since its disclosure in 2017. CISA has confirmed active exploitation and added this vulnerability to the KEV catalog with a known ransomware association, reflecting its use in major campaigns including WannaCry and NotPetya. The EPSS percentile of 99.7% places it among the most exploited vulnerabilities ever cataloged. This vulnerability was part of the EternalRomance and related exploit tools leaked by the Shadow Brokers group, and public exploit code has been widely available since 2017. When combined with CVE-2017-0144 (EternalBlue) and other SMBv1 flaws, attackers can chain information disclosure with remote code execution for complete system compromise.
Remediation
- Apply Microsoft security updates as specified in MS17-010, which addresses CVE-2017-0147 along with related SMBv1 vulnerabilities. This is the definitive fix recommended by CISA's KEV required action.
- Disable SMBv1 entirely on all systems where it is not strictly required. SMBv1 is a legacy protocol and Microsoft has recommended disabling it since 2016. Use PowerShell commands or Group Policy to disable the SMBv1 server and client features across your environment.
- Block TCP port 445 at network perimeters and segment internal networks to prevent lateral movement via SMB. Implement firewall rules to restrict SMB traffic to only authorized hosts.
- Monitor network traffic for anomalous SMBv1 activity, including unexpected connections to port 445 and known EternalBlue/EternalRomance signatures in intrusion detection systems.
- Conduct a thorough review of all Windows systems to identify any remaining SMBv1-enabled hosts, particularly legacy systems that may have been missed during patching cycles.
Technical Details
CVE-2017-0147 resides in the SMBv1 server implementation in Microsoft Windows. The vulnerability is triggered when the SMBv1 service improperly handles certain transaction requests, causing it to return portions of kernel or process memory in response to crafted SMB packets. This information disclosure mechanism is technically classified under CWE-200, where the server fails to properly validate and sanitize response data before sending it to the requesting client. The attack vector is network-based, targeting TCP port 445 where the SMB service listens, and requires no authentication or user interaction. This vulnerability was part of a cluster of SMBv1 flaws (MS17-010) that together enabled the EternalBlue, EternalRomance, and EternalSynergy exploit chains, where information disclosure from CVE-2017-0147 could provide memory layout data used to improve the reliability of subsequent code execution exploits.
Frequently Asked Questions
Is CVE-2017-0147 being actively exploited?
Yes, CVE-2017-0147 has been actively exploited since 2017 and continues to pose a risk to unpatched systems. CISA has confirmed active exploitation and added it to the KEV catalog with a known ransomware association. The EPSS percentile of 99.7% reflects extremely high real-world exploitation activity, driven by its inclusion in the EternalBlue family of exploits.
What products are affected by CVE-2017-0147?
CVE-2017-0147 affects the SMBv1 server component in Microsoft Windows. This includes multiple versions of Windows such as Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016. Any system with the SMBv1 server feature enabled is potentially vulnerable.
How do I fix CVE-2017-0147?
Apply the MS17-010 security update from Microsoft, which patches CVE-2017-0147 and related SMBv1 vulnerabilities. Additionally, disable SMBv1 entirely on all systems where it is not required and block TCP port 445 at network boundaries. See the Remediation section for detailed steps.
How severe is CVE-2017-0147?
CVE-2017-0147 is an information disclosure vulnerability that becomes critically dangerous when chained with related SMBv1 exploits. Its EPSS percentile of 99.7% places it among the most exploited CVEs in existence. The ransomware association with WannaCry and NotPetya underscores the severe real-world impact of this vulnerability family.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.