MS.SMB.Server.SMB1.Trans2.Secondary.Handling.Code.Execution

description-logoDescription

This indicates an attack attempt to exploit a Remote Code Execution vulnerability in Microsoft SMB Servers.
The vulnerability is due to an error when the vulnerable software handles a maliciously crafted SMBv1 request. A remote attacker may be able to exploit this to execute arbitrary code within the context of the application, via a crafted request. This vulnerability was leaked as part of the Shadow Brokers leak and is code-named EternalBlue. It has been exploited in the wild and is also linked to the Wannacry ransomware attack.

affected-products-logoAffected Products

Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 8.1
Windows Server 2012 and Windows Server 2012 R2
Windows RT 8.1
Windows 10
Windows Server 2016
Windows Server Core installation option

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
http://technet.microsoft.com/security/bulletin/MS17-010

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)

References

RANSOMWARE:WANNACRY