CVE-2017-11885
published 2017-12-12CVE-2017-11885: Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows…
PriorityP358medium6.6CVSS 3.0
AVNACHPRHUINSUCHIHAH
EXPLOIT
EPSS
45.52%
98.7th percentile
Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a remote code execution vulnerability due to the way the Routing and Remote Access service handles requests, aka "Windows RRAS Service Remote Code Execution Vulnerability".
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2016 | — | — |
| microsoft_corporation | microsoft_windows | — | — |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1511 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1703 | — | — |
| msrc | windows_10_version_1709 | — | — |
| msrc | windows_7 | — | — |
| msrc | windows_8.1 | — | — |
| msrc | windows_rt_8.1 | — | — |
| msrc | windows_server_2008 | — | — |
| msrc | windows_server_2008_r2 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
| msrc | windows_server_version_1709 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution"; flow:established,to_server; content:"|21 00 00 00 10 27 00 00 a4 86 01 00 41 41 41 41 04 00 00 00 41 41 41 41 a4 86 01 00 ad 0b 2d 06 d0 ba 61 41 41 90 90 90 90 90|"; reference:cve,2017-11885; reference:url,exploit-db.com/exploits/44616/; classtype:attempted-user; sid:2025824; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_07_11, cve CVE_2017_11885, deployment Perimeter, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
bytes↗
|21 00 00 00 10 27 00 00 a4 86 01 00 41 41 41 41 04 00 00 00 41 41 41 41 a4 86 01 00 ad 0b 2d 06 d0 ba 61 41 41 90 90 90 90 90|
- →Detect exploit traffic targeting TCP/445 carrying the RRAS RPC stub NDR payload — match the specific byte sequence beginning with 0x21000000 (dwPid=PID_IP) followed by the MIB_OPAQUE_QUERY structure fields and the pointer gadget 0xad0b2d06. ↗
- →Monitor for DCE-RPC bind requests to RRAS endpoint UUID 8f09f000-b7ed-11ce-bbd2-00001a181cad over the \pipe\browser named pipe, especially opnum 0x1e (MIBEntryGetFirst) with oversized rgdwVarIndex fields. ↗
- →Systems with Routing and Remote Access Service (RRAS) enabled are the exclusive attack surface; audit and alert on RRAS service state changes or unexpected RRAS process network activity. ↗
- ·Disabling RRAS on systems that do not require it fully mitigates the vulnerability, as the attack vector requires RRAS to be enabled. ↗
CVSS provenance
nvdv3.06.6MEDIUMCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.5HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
vendor_msrc6.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows RRAS Service Remote Code Execution Vulnerability
vendor_msrc·2017-12-12·CVSS 6.6
CVE-2017-11885 [MEDIUM] Windows RRAS Service Remote Code Execution Vulnerability
Windows RRAS Service Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could execute code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to run a specially crafted application against an RPC server which has Routing and Remote Access enabled. Routing and Remote Access is a non-default configuration; systems without it enabled are not vulnerable.
The security update addresses the vulnerability by correcting how the Routing and Remote Access service handles requests.
Microsoft Windows: M
GHSA
GHSA-9v5f-8fvr-6hf3: Windows 7 SP1, Windows 8
ghsa_unreviewed·2022-05-14
CVE-2017-11885 [HIGH] CWE-20 GHSA-9v5f-8fvr-6hf3: Windows 7 SP1, Windows 8
Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a remote code execution vulnerability due to the way the Routing and Remote Access service handles requests, aka "Windows RRAS Service Remote Code Execution Vulnerability".
Suricata
ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution
suricata·2018-07-11
CVE-2017-11885 ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution
ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution
Rule: alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution"; flow:established,to_server; content:"|21 00 00 00 10 27 00 00 a4 86 01 00 41 41 41 41 04 00 00 00 41 41 41 41 a4 86 01 00 ad 0b 2d 06 d0 ba 61 41 41 90 90 90 90 90|"; reference:cve,2017-11885; reference:url,exploit-db.com/exploits/44616/; classtype:attempted-user; sid:2025824; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_07_11, cve CVE_2017_11885, deployment Perimeter, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_te
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Ausnutzung von Schwachstellen
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft M
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits & Vulnerabilities
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro 2017/12/13 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Malwar
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits & Vulnerabilities
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Malw
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits & Vulnerabilities
# December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro
2017/12/13
Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940, two remote code execution vulnerabilities concerning the Microsoft Malware
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Sfruttamento vulnerabilità
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Malw
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits y vulnerabilidades
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Mal
Qualys
December 2017 Patch Tuesday: Quiet End to the Year
blogs_qualys·2017-12-12·CVSS 6.6
[MEDIUM] December 2017 Patch Tuesday: Quiet End to the Year
This December Patch Tuesday is considerably lighter than last month’s patch releases. While only three of the fixes were for Windows operating systems, the majority of the vulnerabilities to pay attention to are Browser/Scripting Engine-based.
Overall, this month’s updates address are fixes for 32 unique CVEs, 19 of which are critical, and 24 of which address remote code execution at varying severity levels. No active exploits are listed by Microsoft again this month.
From a prioritization standpoint, again we turn our focus to the browsers and the Scripting Engine Memory Corruption Vulnerabilities. We recommend prioritizing patching user-facing workstations to address the 19 critical Internet Explorer and Edge updates released today by Microsoft, as they are listed as “Exploitation More
Talos
Microsoft Patch Tuesday - December 2017
blogs_talos·2017-12-12·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - December 2017
Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 34 new vulnerabilities with 21 of them rated critical and 13 of them rated important. These vulnerabilities impact Edge, Exchange, Internet Explorer, Office, Scripting Engine, Windows, and more.
In addition to the 33 vulnerabilities addressed, Microsoft has also released an update for Microsoft Office which improves security by disabling the Dynamic Data Exchange (DDE) protocol. This update is detailed in ADV170021 and impacts all supported versions of Office. Organizations who are unable to install this update should consult the advisory for workaround that help mitigate DDE exploitation attempts.
##
Qualys
December 2017 Patch Tuesday: Quiet End to the Year | Qualys
blogs_qualys·2017-12-12·CVSS 6.6
[MEDIUM] December 2017 Patch Tuesday: Quiet End to the Year | Qualys
This December Patch Tuesday is considerably lighter than last month’s patch releases. While only three of the fixes were for Windows operating systems, the majority of the vulnerabilities to pay attention to are Browser/Scripting Engine-based.
Overall, this month’s updates address are fixes for 32 unique CVEs, 19 of which are critical, and 24 of which address remote code execution at varying severity levels. No active exploits are listed by Microsoft again this month.
From a prioritization standpoint, again we turn our focus to the browsers and the Scripting Engine Memory Corruption Vulnerabilities. We recommend prioritizing patching user-facing workstations to address the 19 critical Internet Explorer and Edge updates released today by Microsoft, as they are listed as “Exploitation More
http://www.securityfocus.com/bid/102055http://www.securitytracker.com/id/1039987https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11885https://www.exploit-db.com/exploits/44616/http://www.securityfocus.com/bid/102055http://www.securitytracker.com/id/1039987https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11885https://www.exploit-db.com/exploits/44616/
2017-12-12
Published