SB2017101014 - Multiple vulnerabilities in Microsoft Windows SMB Server

Description

This security bulletin contains information about 4 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2017-11780)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The vulnerability exists due to input validation error in the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. A remote attacker can send a specially crafted packet to a targeted SMBv1 server and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Improper input validation (CVE-ID: CVE-2017-11781)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to input validation error in the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. A remote attacker can send a specially crafted packet to a targeted SMBv1 server and cause the affected system to crash

Successful exploitation of this vulnerability results in denial of service.

3) Privilege escalation (CVE-ID: CVE-2017-11782)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The vulnerability exists due to default Windows SMB Server configuration. A remote attacker who can send SMB messages to an impacted Windows SMB Server that accept requests via named pipes is able to gain elevated privileges.

4) Information disclosure (CVE-ID: CVE-2017-11815)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to an error when the Windows SMB Server handles authenticated requests. A remote attacker can send SMB messages to an impacted Windows SMB Server and gain access arbitrary files.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11780
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11782
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11815