Microsoft Windows SMBv1远程代码执行漏洞

详细信息

漏洞类型

输入验证错误

漏洞描述

Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。SMBv1 server是其中的一个服务器协议组件。 由于SMBv1服务对请求的不当处理，Microsoft Windows可能允许远程攻击者在系统上执行任意代码。通过发送特制数据包，攻击者可以利用此漏洞在受影响的系统上执行任意代码。

修复建议

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://technet.microsoft.com/zh-cn/library/security/ms17-010

参考链接

• https://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• https://www.exploit-db.com/exploits/47456
• http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html

  NVD · x_refsource_MISC

• https://www.exploit-db.com/exploits/41891/

  NVD · exploit · x_refsource_EXPLOIT-DB

• https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf

  NVD · x_refsource_CONFIRM

• https://www.exploit-db.com/exploits/41987/

  NVD · exploit · x_refsource_EXPLOIT-DB

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143

  NVD · x_refsource_CONFIRM

• https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf

  NVD · x_refsource_CONFIRM

• http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html

  NVD · x_refsource_MISC

• https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

  NVD · x_refsource_MISC

• https://www.exploit-db.com/exploits/43970/

  NVD · exploit · x_refsource_EXPLOIT-DB

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0143

  NVD · US Government Resource