CVE-2017-0148
Microsoft SMBv1 Server Remote Code Execution Vulnerability
Description
CVE-2017-0148 is a remote code execution vulnerability in Microsoft's SMBv1 server implementation, closely related to the notorious EternalBlue exploit (MS17-010). The flaw allows unauthenticated attackers to send specially crafted packets to an SMBv1 server to execute arbitrary code with SYSTEM privileges. This vulnerability was weaponized in the devastating WannaCry and NotPetya ransomware campaigns that caused billions of dollars in damage worldwide. It has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with confirmed ransomware associations, and carries an EPSS score of 97.5% (99.9th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | server message block | 1.0 |
| siemens | acuson p300 firmware | 13.02; 13.03; 13.20; 13.21 |
| siemens | acuson p500 firmware | va10; vb10 |
| siemens | acuson sc2000 firmware | >= 4.0, < 4.0e; 5.0a |
| siemens | acuson x700 firmware | 1.0; 1.1 |
| siemens | syngo sc2000 firmware | >= 4.0, <= 4.0e; 5.0a |
| siemens | tissue preparation system firmware | All versions |
| siemens | versant kpcr molecular system firmware | All versions |
| siemens | versant kpcr sample prep firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/96706(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037991(Broken Link, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf(Third Party Advisory)
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02(Third Party Advisory, US Government Resource)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41891/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41987/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0148(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
This weakness involves performing operations on a memory buffer without properly ensuring that read and write actions stay within the buffer's boundaries. In CVE-2017-0148, the SMBv1 server fails to properly handle certain transaction request types, leading to a buffer overflow that enables remote code execution. For more details, see CWE-119.
Impact Analysis
The impact of CVE-2017-0148 has been demonstrated at a global scale through the WannaCry and NotPetya attacks. Successful exploitation provides SYSTEM-level access to the target machine, the highest privilege level on Windows systems. The vulnerability is network-exploitable without authentication, allowing attackers to compromise systems by simply having network access to port 445. The wormable nature enabled automated propagation across networks, leading to catastrophic organizational damage including hospital system shutdowns, shipping logistics paralysis, and manufacturing downtime. This vulnerability remains a significant threat as many legacy systems continue to run unpatched SMBv1.
Exploit Maturity
CVE-2017-0148 is one of the most extensively exploited vulnerabilities in history and was added to CISA's KEV catalog on April 6, 2022, with confirmed ransomware use (Known). The EPSS score of 97.5% (99.9th percentile) reflects the near-universal exploitation. The EternalBlue exploit was originally developed by the NSA and leaked by the Shadow Brokers group in April 2017. It was subsequently integrated into WannaCry, NotPetya, and numerous other malware campaigns. Exploit code remains widely available and actively used by threat actors of all sophistication levels.
Remediation
- Apply Microsoft security update MS17-010 immediately if not already applied, as required by CISA's KEV catalog. This critical patch has been available since March 2017.
- Disable SMBv1 on all systems where it is not absolutely required. Use PowerShell:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. - Block SMB traffic (TCP port 445) at the network perimeter to prevent external exploitation attempts.
- Implement network segmentation to limit SMB traffic between systems, reducing the potential for lateral worm-like propagation.
- Conduct a thorough inventory of all systems still running SMBv1 and develop a migration plan to SMBv2/v3 or modern alternatives.
Technical Details
CVE-2017-0148 exists in the Windows SMBv1 server driver (srv.sys) and is triggered by sending specially crafted SMB transaction requests. The vulnerability occurs during the processing of SMB_COM_TRANSACTION2 and SMB_COM_NT_TRANSACT requests, where the server fails to properly validate the TotalDataCount and related fields. By sending a carefully crafted sequence of SMB packets that manipulates the server's memory allocation and transaction handling, an attacker can achieve a buffer overflow that overwrites critical kernel structures. The exploit leverages the kernel pool allocation behavior to achieve reliable code execution at the SYSTEM privilege level. The entire attack can be performed remotely through TCP port 445 without any form of authentication.
Frequently Asked Questions
What is CVE-2017-0148?
CVE-2017-0148 is one of several vulnerabilities in Microsoft's SMBv1 protocol addressed by the MS17-010 security update. It is part of the EternalBlue exploit chain that was used in the WannaCry and NotPetya ransomware campaigns. The vulnerability allows remote code execution with SYSTEM privileges.
How is this related to EternalBlue?
EternalBlue is the exploit name for the MS17-010 vulnerability family, which includes CVE-2017-0148 along with several related SMBv1 flaws. The exploit was developed by the NSA and leaked by the Shadow Brokers group in 2017, after which it was rapidly weaponized by ransomware operators.
Is my system still at risk in 2024?
If your systems have been updated with Microsoft patches from March 2017 or later, they are protected against this specific vulnerability. However, organizations with legacy systems, unmanaged devices, or systems that cannot be updated may still be at risk. SMBv1 should be disabled wherever possible.
What was the impact of WannaCry and NotPetya?
WannaCry infected over 200,000 systems in 150 countries in May 2017, causing estimated damages of billions of dollars. NotPetya, which struck in June 2017, caused over $10 billion in damages and severely impacted major corporations including Maersk, Merck, and FedEx. Both leveraged CVE-2017-0148 and related SMBv1 vulnerabilities for propagation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.