CVE-2017-0143 is a high-severity vulnerability affecting the SMBv1 server in various versions of Microsoft Windows, including Windows Vista, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows 10, and Windows Server 2016. This vulnerability allows remote attackers to execute arbitrary code via crafted packets, posing a significant risk to affected systems. It is important for users and administrators to be aware of this vulnerability and take appropriate measures to secure their systems.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, you should first check if you're using any of the following Microsoft Windows versions: Vista SP2, Server 2008 SP2 and R2 SP1, 7 SP1, 8.1, Server 2012 Gold and R2, RT 8.1, 10 Gold, 1511, and 1607, or Server 2016. This vulnerability is a remote code execution issue in the SMBv1 server, allowing attackers to execute arbitrary code through crafted packets. Unfortunately, specific signs of being affected by this vulnerability are not readily available, but being aware of your system's version can help you assess your risk.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action to secure your system. First, update your Windows operating system to the latest version, as this will include security patches. Next, disable the SMBv1 protocol on your system, as this is the main target of the vulnerability. Finally, ensure you have a reliable antivirus software installed and updated to protect against potential threats.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, the CVE-2017-0143 vulnerability is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability is named Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability. It was added to the catalog on November 3, 2021, with a due date of May 3, 2022. The required action is to apply updates according to vendor instructions.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which allows attackers to execute arbitrary code through crafted packets. This weakness affects the SMBv1 server in various Windows versions.

For more details

CVE-2017-0143 is a high-severity vulnerability affecting various Windows versions and posing significant risks to affected systems. For a comprehensive overview of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• DOUBLEPULSAR Payload Execution / Neutralization

• Philips Intellispace Portal ISP Vulnerabilities | CISA

• CVE-2017-0143 - Security Update Guide - Microsoft - Windows SMB Remote Code Execution Vulnerability

• SMB DOUBLEPULSAR Remote Code Execution