CVE-2017-0145 Microsoft SMBv1 Remote Code Execution
Remote attackers can execute arbitrary code on Windows systems by sending crafted packets to the SMBv1 server.
- Exploited in the wild
- Since 10 Feb 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-0145?
CVE-2017-0145 is a high-severity memory corruption vulnerability in Microsoft Corporation Windows SMB, published on 17 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.
Which versions are affected by CVE-2017-0145?
It affects 9 products.
Products include Microsoft Server Message Block, Siemens Acuson P300 Firmware, Siemens Acuson P500 Firmware, Siemens Acuson Sc2000 Firmware, Siemens Acuson X700 Firmware, Siemens Syngo Sc2000 Firmware and 3 more.
How do I fix CVE-2017-0145?
No fix has been published for CVE-2017-0145 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-0145 being exploited?
Yes. Attackers have exploited CVE-2017-0145 in the wild since at least 10 Feb 2022, including in ransomware campaigns.
Public exploit code: 3 Metasploit modules, 4 Exploit-DB entries and 1 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Corporation Windows SMB
Sources
Also known as GHSA-jxmr-j43h-4x9p.