The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.

The remote system may be affected by ransomware that encrypts most or all of the files on a user's computer. Then, the software demands that a ransom be paid in order to have the files decrypted. This attack is related to the recent ShadowBrokers dump containing NSA weaponized software exploits.

NNM detected the presence of DOUBLEPULSAR on the remote Windows host. DOUBLEPULSAR is one of multiple Equation Group SMB implants and backdoors disclosed on 2017/04/14 by a group known as the 'Shadow Brokers'. The implant allows an unauthenticated, remote attacker to use SMB as a covert channel to exfiltrate data, launch remote commands, or execute arbitrary code.

The remote Windows host is affected by the following vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit these     vulnerabilities, via a specially crafted packet, to     execute arbitrary code. (CVE-2017-0143, CVE-2017-0144,     CVE-2017-0145, CVE-2017-0146, CVE-2017-0148)

  - An information disclosure vulnerability exists in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet, to disclose sensitive     information. (CVE-2017-0147)

ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers. WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via ETERNALBLUE.

The remote Windows host is missing a security update. It is, therefore, affected by the following vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit these     vulnerabilities, via a specially crafted packet, to     execute arbitrary code. (CVE-2017-0143, CVE-2017-0144,     CVE-2017-0145, CVE-2017-0146, CVE-2017-0148)

  - An information disclosure vulnerability exists in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet, to disclose sensitive     information. (CVE-2017-0147)

ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers. WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via ETERNALBLUE.

ID	Name	Product	Family	Severity
700099	Ransomware Traffic Detected (WannaCry)	Nessus Network Monitor	Generic	critical
700059	SMB Server DOUBLEPULSAR Backdoor / Implant Detection (EternalRocks)	Nessus Network Monitor	Web Servers	critical
97833	MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)	Nessus	Windows	high
97737	MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2017-0146

high

Tenable Plugins

critical

critical

high

high