5 Replies Latest reply on Jun 15, 2017 2:33 PM by cwinning

Using SQL query to find Q numbers associated with CVE's for WannaCry

Codys26 Jun 12, 2017 5:13 PM

Hello,

I was using the SQL query to find the Q numbers listed for the CVE's for WannaCry, CVE-2017-0143 to 0148.

SQL Query To Find CVE Numbers Associated With Qnumbers

However, when I search for any of the CVE numbers, i get the following output:

CVE-2017-0143	19246	SB17-002	Q4012212	March 2017 Security Only Quality Update for Windows 7 SP1 and Windows Server 2008 R2 SP1	2017-03-14 00:00:00.000
CVE-2017-0143	19252	CR17-003	Q4012216	March 2017 Security Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2	2017-03-14 00:00:00.000
CVE-2017-0143	19253	CR17-004	Q4012217	March 2017 Security Monthly Quality Rollup for Windows Server 2012	2017-03-14 00:00:00.000
CVE-2017-0143	19254	SB17-003	Q4012213	March 2017 Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2	2017-03-14 00:00:00.000
CVE-2017-0143	19255	CR17-002	Q4012215	March 2017 Security Monthly Quality Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1	2017-03-14 00:00:00.000
CVE-2017-0143	19256	SB17-004	Q4012214	March 2017 Security Only Quality Update for Windows Server 2012	2017-03-14 00:00:00.000
CVE-2017-0143	19257	MS17-010	Q4012598	Security Update for Microsoft Windows SMB Server (4013389)	2017-03-14 00:00:00.000

Shouldn't the April and May security rollup also be listed for these CVEs?

Thanks!

1. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

cwinning Jun 13, 2017 6:48 AM (in response to Codys26)

Hello,

The only addition to my list is Q4013429 which was released in March, was a CVE missed in your script?

Here is more information on the patches for WannaCry: Latest information on WannaCrypt and How to Protect Against It (Shavlik Protect, Patch for Windows Server)

I used an API command in version 9.3 to add patches for CVEs, CVE-2017-0143 through 0148. These were run from administrative Powershell CMD:

Add-PatchGroup -Name 'WannaCry' -Description 'CVE-2017-0143 through 0148'
Add-PatchGroupItem -Name 'WannaCry' -Cve 'CVE-2017-0143','CVE-2017-0144','CVE-2017-0145','CVE-2017-0146','CVE-2017-0147','CVE-2017-0148'

These patches were added a new Patch Group based on the CVEs in the input:

Here is the export of the group:

Q4012212
Q4012213
Q4012214
Q4012215
Q4012216
Q4012217
Q4012598
Q4012598
Q4013429
Q4013429

Thanks,
Charles
Like Show 0 Likes(0)

Actions
2. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

Codys26 Jun 14, 2017 10:25 PM (in response to cwinning)

Hi Charles,

When I scan my servers against the group you provided, I receive incomplete results. If 0 patches are missing and 0 are installed, does that mean they are superceded? If so, why isn't the cve's tied to the superceded patch?

Thanks!
Like Show 0 Likes(0)

Actions
3. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

cwinning Jun 15, 2017 8:01 AM (in response to Codys26)

Hello,

I just spot checked a patch that supersedes one of the original patches, MS17-05-2K8. It does include have a different CVE.

We have no control on which CVEs are associated with updates.

Thanks,
Charles
Like Show 0 Likes(0)

Actions
4. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

Codys26 Jun 15, 2017 2:10 PM (in response to cwinning)

That is no problem. I wasn't sure if that was something controlled through Shavlik or not.

Thanks!
Like Show 0 Likes(0)

Actions
5. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

cwinning Jun 15, 2017 2:33 PM (in response to Codys26)

No worries, glad I could help.

Thanks,
Charles
Like Show 0 Likes(0)

Actions

Go to original post

Using SQL query to find Q numbers associated with CVE's for WannaCry

1. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

2. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

3. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

4. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

5. Re: Using SQL query to find Q numbers associated with CVE's for WannaCry

Actions

More Like This

Legend