CVE-2017-0143

What Is SMBv1?

Server Message Block version 1 (SMBv1) is the original Windows file sharing and network communication protocol, designed in the 1980s for LAN file and printer sharing. SMBv1 is built into Windows and runs on TCP port 445. While superseded by SMBv2 (Vista) and SMBv3 (Windows 8), SMBv1 remained enabled by default in all Windows versions through Windows 10 1709, creating a decades-old attack surface exposed on virtually every Windows system in the world.

Overview

CVE-2017-0143 is a remote code execution vulnerability in the Windows SMBv1 server component, patched in MS17-010 (March 14, 2017). It is part of the MS17-010 family — a group of SMBv1 vulnerabilities (CVE-2017-0143 through CVE-2017-0148) leaked by the Shadow Brokers as NSA Equation Group exploit tools in April 2017, one month after Microsoft's patch. CVE-2017-0143 corresponds to EternalRomance — one of the Shadow Brokers-published Equation Group tools that exploits SMBv1 transaction handling to achieve remote code execution. The entire MS17-010 family powered the catastrophic WannaCry (May 2017) and NotPetya (June 2017) ransomware/destructive malware outbreaks. CISA added CVE-2017-0143 to the KEV catalog in November 2021.

Affected Versions

Technical Details

Root Cause: SMBv1 Transaction Buffer Overflow

CVE-2017-0143 is a memory buffer vulnerability (CWE-119) in the Windows SMBv1 server's handling of transaction requests. The SMBv1 protocol supports transaction commands (SMB_COM_TRANSACTION, SMB_COM_TRANSACTION2, SMB_COM_NT_TRANSACT) that carry data and parameters in structured packets. The SMBv1 server improperly handles certain transaction packet structures, leading to memory corruption in the kernel-mode SMBv1 server driver (srv.sys).

Distinction from CVE-2017-0144 (EternalBlue):

• CVE-2017-0143 (EternalRomance): PR:L — requires low-privilege access (NULL session or guest account); targets Windows Server specifically; exploits different SMBv1 code paths than EternalBlue
• CVE-2017-0144 (EternalBlue): PR:N — no authentication required; the exploit used by WannaCry and NotPetya for mass propagation

Shadow Brokers Leak and WannaCry/NotPetya

The April 14, 2017 Shadow Brokers dump published EternalRomance (CVE-2017-0143) alongside EternalBlue (CVE-2017-0144) and other MS17-010 tools as NSA Equation Group capabilities. The tools provided ready-made exploits for these SMBv1 vulnerabilities, enabling rapid adoption by criminal and state actors:

• WannaCry (May 12, 2017): Used EternalBlue (CVE-2017-0144) primarily, but the entire MS17-010 family (including CVE-2017-0143) contributed to the devastation
• NotPetya (June 27, 2017): Used EternalBlue and EternalRomance (CVE-2017-0143) together for propagation across networks

Attack Characteristics

Discovery

Discovered by the NSA's Equation Group and weaponized as EternalRomance; publicly disclosed when the Shadow Brokers published the tool on April 14, 2017 — one month after Microsoft had patched it in MS17-010.

Exploitation Context

• WannaCry and NotPetya: The MS17-010 family of vulnerabilities enabled the most damaging cyberattacks in history at the time — WannaCry infected 200,000+ systems in 150 countries in days; NotPetya caused $10+ billion in damages globally; both used SMBv1 for self-propagating worm-like spread
• Unpatched systems long after patch: Despite the March 2017 patch, millions of Windows systems remained unpatched when WannaCry struck in May 2017; many organizations ran Windows 7/Server 2008 on critical systems without automated patching
• EternalRomance in targeted attacks: Beyond mass ransomware campaigns, EternalRomance (CVE-2017-0143) was used by nation-state actors in targeted intrusions against specific organizations before and after the Shadow Brokers disclosure
• CISA KEV (2021): Added November 3, 2021 in the initial KEV batch — among the most well-documented exploited vulnerabilities in history

Remediation

1. Apply MS17-010 immediately — patch Windows systems with the March 2017 security update. This is one of the most critical patches in Windows history.

2. Disable SMBv1 — SMBv1 is a 30+ year old protocol with no modern security properties; disable it on all systems:

   Set-SmbServerConfiguration -EnableSMB1Protocol $false
   

3. Block SMBv1 at the network perimeter — block TCP port 445 inbound from the internet at firewall/perimeter. Internal segmentation should also restrict SMBv1 traffic between network zones.

4. Segment internal networks — limit lateral movement by preventing SMBv1 traffic from propagating across VLAN boundaries; worm propagation requires SMBv1 reachability between hosts.

5. Replace end-of-life Windows versions — Windows XP, Server 2003, and Server 2008 without extended support cannot receive regular patches; replace these systems urgently.