SB2017101014 - Multiple vulnerabilities in Microsoft Windows SMB Server

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2017-11780)

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The vulnerability exists due to input validation error in the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. A remote attacker can send a specially crafted packet to a targeted SMBv1 server and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Improper input validation (CVE-ID: CVE-2017-11781)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to input validation error in the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. A remote attacker can send a specially crafted packet to a targeted SMBv1 server and cause the affected system to crash

Successful exploitation of this vulnerability results in denial of service.

3) Privilege escalation (CVE-ID: CVE-2017-11782)

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The vulnerability exists due to default Windows SMB Server configuration. A remote attacker who can send SMB messages to an impacted Windows SMB Server that accept requests via named pipes is able to gain elevated privileges.

4) Information disclosure (CVE-ID: CVE-2017-11815)

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to an error when the Windows SMB Server handles authenticated requests. A remote attacker can send SMB messages to an impacted Windows SMB Server and gain access arbitrary files.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11780
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11782
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11815