CVE20170144

CVE-2017-0144, commonly known as EternalBlue, is a critical remote code execution vulnerability in Microsoft Windows Server Message Block version 1.0 (SMBv1). The flaw allows an unauthenticated attacker to execute arbitrary code on a target system by sending specially crafted SMB packets to a vulnerable Windows machine.

The vulnerability resides in the SMBv1 server component and can enable remote code execution with the same privileges as the SMB service, potentially giving the attacker full control of the affected system. Successful exploitation requires no user interaction beyond establishing a connection to the SMB service.

Microsoft released the security update MS17-010 on March 14, 2017 to address this vulnerability across supported Windows versions, and patches were also provided for older, out-of-support systems such as Windows XP and Windows Server 2003 as part of the same advisory. The flaw gained particular notoriety after being exploited by the WannaCry ransomware in May 2017, which used EternalBlue to propagate rapidly within networks.

Mitigation and remediation actions focus on applying the MS17-010 updates, disabling SMBv1 where feasible, and restricting access to the SMB service. Network protections include closing or filtering inbound SMB traffic on port 445, implementing proper network segmentation, and maintaining up-to-date operating system and software patches. Due to its wormable nature, rapid patching and defense-in-depth measures were widely emphasized in incident responses following its disclosure.