Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
13 versions affected across 28 products
Para protegerse contra APT28, revise y parchee vulnerabilidades conocidas, como CVE-2017-0143. Implemente soluciones de seguridad avanzadas, como sistemas de detección de intrusiones. Monitoree tráfico de red sospechoso. Utilice herramientas de seguridad como VirusTotal y Malwaredomainlist. (6/6)
Post summary
The text provides advice to patch known vulnerabilities, specifically CVE‑2017‑0143, as a defense measure against APT28.
APT28 utiliza técnicas de spear phishing, malware y exploits para vulnerar sistemas. Algunos de los exploits utilizados incluyen CVE-2017-0143, CVE-2017-0144 y CVE-2017-0170. También han utilizado herramientas como malware tipo backdoor, como Sofacy y Zebrocy. APT28 ha utilizado direcciones IP de servidores C2 en Rusia. (3/6)
Post summary
The tweet notes that APT28 has used the Windows SMB exploits CVE‑2017‑0143, CVE‑2017‑0144, and CVE‑2017‑0170, but provides no technical details, demonstrations, or mitigation information.
41 of 41 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | server_message_block | 1.0 | - | - |
| OS | microsoft | windows_10_1507 | - | - | x64 |
| OS | microsoft | windows_10_1507 | - | - | x86 |
| OS | microsoft | windows_10_1511 | - | - | x64 |
| OS | microsoft | windows_10_1511 | - | - | x86 |
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_7 | - | - | - |
| OS | microsoft | windows_8.1 | - | - | - |
| OS | microsoft | windows_rt_8.1 | - | - | - |
| OS | microsoft | windows_server_2008 | - | - | - |
| OS | microsoft | windows_server_2008 | r2 | - | - |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_vista | - | - | - |
| App | philips | intellispace_portal | 7.0 | - | - |
| App | philips | intellispace_portal | 8.0 | - | - |
| HW | siemens | acuson_p300 | - | - | - |
| OS | siemens | acuson_p300_firmware | 13.02 | - | - |
| OS | siemens | acuson_p300_firmware | 13.03 | - | - |
| OS | siemens | acuson_p300_firmware | 13.20 | - | - |
| OS | siemens | acuson_p300_firmware | 13.21 | - | - |
| HW | siemens | acuson_p500 | - | - | - |
| OS | siemens | acuson_p500_firmware | va10 | - | - |
| OS | siemens | acuson_p500_firmware | vb10 | - | - |
| HW | siemens | acuson_sc2000 | - | - | - |
| OS | siemens | acuson_sc2000_firmware | - | - | - |
| OS | siemens | acuson_sc2000_firmware | 5.0a | - | - |
| HW | siemens | acuson_x700 | - | - | - |
| OS | siemens | acuson_x700_firmware | 1.0 | - | - |
| OS | siemens | acuson_x700_firmware | 1.1 | - | - |
| HW | siemens | syngo_sc2000 | - | - | - |
| OS | siemens | syngo_sc2000_firmware | - | - | - |
| OS | siemens | syngo_sc2000_firmware | 5.0a | - | - |
| HW | siemens | tissue_preparation_system | - | - | - |
| OS | siemens | tissue_preparation_system_firmware | - | - | - |
| HW | siemens | versant_kpcr_molecular_system | - | - | - |
| OS | siemens | versant_kpcr_molecular_system_firmware | - | - | - |
| HW | siemens | versant_kpcr_sample_prep | - | - | - |
| OS | siemens | versant_kpcr_sample_prep_firmware | - | - | - |