vendor:
by:
Sean Dillon
8.1
CVSS
HIGH
Remote Code Execution
CWE
Product Name:
Affected Version From:
Affected Version To:
Patch Exists: YES
Related CWE: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148
CPE:
Metasploit:
https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-0143/, https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-0144/, https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-0145/, https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-0146/, https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-0147/, https://www.rapid7.com/db/vulnerabilities/msft-cve-2017-0148/
Platforms Tested:
2017
MS17-010 SMB RCE Detection
This module uses information disclosure to determine if MS17-010 has been patched or not. It connects to the IPC$ tree and attempts a transaction on FID 0. If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does not have the MS17-010 patch. This module does not require valid SMB credentials in default server configurations. It can log on as the user "" and connect to IPC$."
Mitigation:
Apply the MS17-010 patch
