CVE-2017-11780
published 2017-10-13CVE-2017-11780: The Server Message Block 1.0 (SMBv1) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT…
PriorityP345high7CVSS 3.0
AVNACHPRNUINSUCHILAL
EPSS
9.96%
95.1th percentile
The Server Message Block 1.0 (SMBv1) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows a remote code execution vulnerability when it fails to properly handle certain requests, aka "Windows SMB Remote Code Execution Vulnerability".
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spamassassin | >= 0 < 3.4.2-0ubuntu0.14.04.1 | 3.4.2-0ubuntu0.14.04.1 |
| apache | spamassassin | >= 0 < 3.4.2-0ubuntu0.16.04.1 | 3.4.2-0ubuntu0.16.04.1 |
| apache | spamassassin | >= 0 < 3.4.2-0ubuntu0.18.04.1 | 3.4.2-0ubuntu0.18.04.1 |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
| microsoft_corporation | server_message_block_1.0 | — | — |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1511 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1703 | — | — |
| msrc | windows_7 | — | — |
| msrc | windows_8.1 | — | — |
| msrc | windows_rt_8.1 | — | — |
| msrc | windows_server_2008 | — | — |
| msrc | windows_server_2008_r2 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
CVSS provenance
nvdv3.07.0HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv5.3MEDIUM
vendor_msrc8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows SMB Remote Code Execution Vulnerability
vendor_msrc·2017-10-10·CVSS 8.1
CVE-2017-11780 [HIGH] Windows SMB Remote Code Execution Vulnerability
Windows SMB Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server.
To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server.
The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.
Windows SMB Server: Windows SMB Server
Issuing CNA: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Expl
GHSA
GHSA-2762-xq5x-qh8r: The Server Message Block 1
ghsa_unreviewed·2022-05-13
CVE-2017-11780 [HIGH] GHSA-2762-xq5x-qh8r: The Server Message Block 1
The Server Message Block 1.0 (SMBv1) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows a remote code execution vulnerability when it fails to properly handle certain requests, aka "Windows SMB Remote Code Execution Vulnerability".
OSV
spamassassin vulnerabilities
osv·2018-11-06·CVSS 5.3
CVE-2017-15705 spamassassin vulnerabilities
spamassassin vulnerabilities
It was discovered that SpamAssassin incorrectly handled certain unclosed
tags in emails. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2017-15705)
It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11780)
It was discovered that SpamAssassin incorrectly handled meta rule syntax. A
local attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11781)
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/101110http://www.securitytracker.com/id/1039528https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11780http://www.securityfocus.com/bid/101110http://www.securitytracker.com/id/1039528https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11780
2017-10-13
Published