CVE-2017-0143 Microsoft Windows Server Message Block (SMBv1) Remote Code Execution
Remote attackers can execute arbitrary code on Windows systems by sending crafted packets to the SMBv1 server.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-0143?
CVE-2017-0143 is a high-severity memory corruption vulnerability in Microsoft Corporation Windows SMB, published on 17 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Which versions are affected by CVE-2017-0143?
It affects 10 products.
Products include Microsoft Server Message Block, Philips Intellispace Portal, Siemens Acuson P300 Firmware, Siemens Acuson P500 Firmware, Siemens Acuson Sc2000 Firmware, Siemens Acuson X700 Firmware and 4 more.
How do I fix CVE-2017-0143?
No fix has been published for CVE-2017-0143 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-0143 being exploited?
Yes. Attackers have exploited CVE-2017-0143 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 5 Metasploit modules, 5 Exploit-DB entries and 14 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Corporation Windows SMB
Sources
Also known as GHSA-fqgw-29m3-pwh5.