Windows Search Remote Code Execution Vulnerability

Reference: CVE-2017-8620
Version: 1.0
Affected software: All supported Windows versions (7, 8.1, 10, RT 8.1, Server 2008, 2012, 2016)
Type: Remote Code Execution

Sources

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2...
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8620

Risks

Successful exploitation of these vulnerabilities may allow the attacker to remotely execute code through the Windows Search service. This could allow the attacker to take control of the affected system.

Summary

A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit the vulnerability, the attacker could send specially crafted messages to the Windows Search service. An attacker with access to a target computer could exploit this vulnerability to elevate privileges and take control of the computer. Additionally, in an enterprise scenario, a remote unauthenticated attacker could remotely trigger the vulnerability through an SMB connection and then take control of a target computer.
The security update addresses the vulnerability by correcting how Windows Search handles objects in memory.

Recommend action

Patch the systems with the patches released by Microsoft on https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2...

Workaround

1) Disable WSearch service: find howto at bottom of page https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2...

2) Block SMB connections in and out of the network on the firewall(s)

Article on CERT.be