CVE-2017-0270

EUVD-2017-0626

12.05.2017, 14:29

Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka "Windows SMB Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 94%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_10	-
microsoft	windows_7	-
microsoft	windows_8.1	*
microsoft	windows_rt_8.1	-
microsoft	windows_server_2008	-
microsoft	windows_server_2012	-
microsoft	windows_server_2016	-

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4019474
1511 (x64, x86)	KB4019473
1607 (x64, x86)	KB4019472
1703 (x64, x86)	KB4016871

Windows 7

Service Pack 1 (x64, x86)

KB4019264

Windows 8.1

(x64, x86)

KB4019215

Windows RT 8.1

All

KB4019215

Windows Server 2008

Service Pack 2 (x64, x86)	KB4018466
Service Pack 2 Server Core (x64, x86)	KB4018466

Windows Server 2008 R2

Service Pack 1 (x64)	KB4019264
Service Pack 1 Server Core (x64)	KB4019264

Windows Server 2012

Server Core	KB4019216
Standard	KB4019216

Windows Server 2012 R2

Server Core	KB4019215
Standard	KB4019215

Windows Server 2016

Server Core	KB4019472
Standard	KB4019472

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://www.securityfocus.com/bid/98264

https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0270

http://www.securityfocus.com/bid/98264

https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0270