CVE-2017-0279

Vulnerability

The Microsoft Server Message Block 1.0 (SMBv1) server on multiple Windows versions (including Windows 7 SP1, Windows 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016) mishandles certain requests, enabling remote code execution. This vulnerability is also referenced in the Philips IntelliSpace Portal advisory as CVE-2017-0279 [1].

Exploitation

An unauthenticated attacker on the network can send a specially crafted SMBv1 packet to the target server. No user interaction or authentication is required to trigger the vulnerability [1]. The advisory indicates exploits that target some vulnerabilities are publicly available, though specific details for this CVE are not disclosed.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the target system in the context of the SMB server, potentially leading to full system compromise [1]. The impact includes unauthorized access to sensitive information, denial of service, or remote code execution.

Mitigation

Microsoft released a security update for this vulnerability as part of the May 2017 Patch Tuesday updates. Affected systems should apply the appropriate update. The ICS-CERT advisory notes that Philips is creating a software update for IntelliSpace Portal to mitigate these vulnerabilities [1]. Workarounds include disabling SMBv1 or blocking TCP port 445 on perimeter firewalls.