APT29 Domain Fronting With TOR

Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years. There has been considerable discussion about domain fronting following the release of a paper detailing these techniques...

CVE-2017-0148

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka...

CVE-2017-0144

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka...

Microsoft Windows SMB Remote Code Execution Vulnerability (CNVD-2017-03460)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. SMBv1 server is one of the server protocol components. A remote code execution vulnerability exists in Microsoft Windows SMB, which can be exploited by a remote attacker to execute code by sending...

Microsoft Windows SMB Remote Code Execution Vulnerability (CNVD-2017-03458)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. SMBv1 server is one of the server protocol components. A remote code execution vulnerability exists in Microsoft Windows SMB, which can be exploited by a remote attacker to execute code by sending...

Microsoft Windows SMB Remote Code Execution Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. SMBv1 server is one of the server protocol components. A remote code execution vulnerability exists in Microsoft Windows SMB, which can be exploited by a remote attacker to execute code by sending...

Microsoft Windows SMB Remote Code Execution Vulnerability (CNVD-2017-03459)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. SMBv1 server is one of the server protocol components. A remote code execution vulnerability exists in Microsoft Windows SMB, which can be exploited by a remote attacker to execute code by sending...

Microsoft Windows Server Message Block Arbitrary Code Execution Vulnerability

Microsoft Windows is a family of operating systems from Microsoft. Microsoft Windows remote users can send specially crafted data to a target SMBv1 server to execute arbitrary code on the target system...

Microsoft Windows SMB Server Multiple Vulnerabilities (4013389)

This host is missing a critical security update according to Microsoft Bulletin MS17-010WannaCrypt SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Windows SMB Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 SMBv1 server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server. To exploit the vulnerability, in most...

Windows SMB Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 SMBv1 server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server. To explo...

Windows SMB Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 SMBv1 server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server. To exploit the vulnerability, in most...

MS17-010: Description of the security update for Windows SMB Server: March 14, 2017

None None...

VulnCheck KEV: CVE-2017-0147

The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet...

PT-2017-1937

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description The issue exists due to insufficient input validation in the SMBv1 protocol of Microsoft Windows. It allows a remote attacker to execute arbitrary code using specially crafted...

Microsoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0146)

A remote code execution vulnerability exist in Microsoft Server Message Block 1.0 SMBv1. The vulnerability is due to the way SMBv1 service handles certain requests. An attacker who successfully exploited the vulnerability could gain code execution on the target server...

VulnCheck KEV: CVE-2017-0143

Microsoft Windows Server Message Block 1.0 SMBv1 contains an unspecified vulnerability that allows for remote code execution...

KLA10977 Multiple vulnerabilities in Microsoft Server Message Block (SMB)

Multiple serious vulnerabilities have been found in Microsoft Server Message Block 1.0SMBv1. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities: 1. An improper handling of certain requests can be...

PT-2017-1935

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description The issue exists due to insufficient input validation in the SMBv1 protocol of the Microsoft Windows operating system. This allows a remote attacker to execute arbitrary code using...

PT-2017-1938

Name of the Vulnerable Software and Affected Versions microsoft server message block 1.0 Description The issue exists due to insufficient input validation in the SMBv1 protocol of the Microsoft Windows operating system. This allows a remote attacker to execute arbitrary code using specially craft...