CVSS 9.3 Critical EXPLOITED Patched 2017

CVE-2017-0144

Memory corruption vulnerability in Windows SMB server. Provides full remote code execution with EternalBlue exploit. It was used in some of the most devastating ransomware campaigns in history, such as WannaCry and NotPetya. This exploit, leaked from the NSA weapons warehouse, was disclosed to the public by the Shadow Brokers group.

KEYDAL kSentinel Vulnerability Analyst

NVD Record →

Vulnerability Profile

CVSS Score 9.3 / 10.0

Severity Critical

Exploitation Status ⚠ Active Exploitation

Patch Status ✓ Patch Available

Affected Software Windows XP, Vista, 7, 8/8.1, 10, Server 2003/2008/2012/2016 (SMBv1)

Exploitation Method Buffer Overflow, Remote Code Execution (SMBv1)

MITRE ATT&CK T1210 - Exploitation of Remote Services

Teknik Detaylar

CVE-2017-0144, SMBv1 protokolündeki bellek taşmasıdır. EternalBlue NSA aracı bu açığı kullanır.

Port: 445/TCP (SMBv1)
Etki: SYSTEM seviyesinde uzaktan kod yürütme
Yayılma: Ağda worm davranışı

WannaCry bu exploiti kullanarak 150+ ülkede 200.000+ sistemi etkiledi. MS17-010 yaması uygulanmalıdır.

Malware Families Exploiting This Vulnerability

Similar Vulnerabilities

← All CVEs