The Patching Friars' AlmanacA calendar of CVE saints

Patron of April 14

EternalBlueHoly card for eternalblue, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 SMB EternalBlue IGNIS AETERNUS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint EternalBlue, Escaped From the Arsenal

Patron of forgotten SMBv1 servers, lost digital weapons, and sysadmins who postponed March's update.

Life

Born in the NSA's arsenals, he was made public by the Shadow Brokers on 14 April 2017. He struck SMBv1, Windows' old file-sharing protocol, and allowed remote code execution without credentials. Microsoft had already published the cure a month earlier in bulletin MS17-010, but many had not installed it: in May came WannaCry, in June NotPetya, and the world learned what a postponed update costs.

Prayer

O Saint EternalBlue, who passed from the arsenal to the town square, let our servers never speak SMBv1 again, and let March's patches be installed by April. Amen.

How to celebrate

Celebrated by installing MS17-010, disabling SMBv1, and closing port 445 to the internet.

A weapon lost is a plague found.

Technical record

Disclosed on
April 14 2017
CVE
CVE-2017-0143CVE-2017-0144
CVSS
8.8Actively exploited (CISA KEV)
Product
Microsoft Corporation · Windows SMB

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

Sources: learn.microsoft.com · zerosum0x0.blogspot.com · en.wikipedia.org

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.