CERT-In Advisory
CIAD-2020-0063
Privilege Escalation vulnerability in Microsoft Windows Netlogon Remote Protocol
Original Issue Date: September 21, 2020
Severity Rating: High
Systems Affected
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation also affected)
- Windows Server 2012 (Server Core installation also affected)
- Windows Server 2012 R2 (Server Core installation also affected)
- Windows Server 2016 (Server Core installation also affected)
- Windows Server 2019 (Server Core installation also affected)
- Windows Server, version 1903 (Server Core installation)
- Windows Server, version 1909 (Server Core installation)
- Windows Server, version 2004 (Server Core installation)
Overview
A vulnerability has been reported in Microsoft Windows Netlogon Remote Protocol, which could be exploited by an attacker to gain elevated privileges on the target system.
Description
The Microsoft Windows Netlogon Remote Protocol (MS-NRPC) is a core authentication component of Active Directory that provides authentication for user and computer accounts.
By sending a number of Netlogon messages in which various fields are filled with zeroes, an unauthenticated attacker could change the computer password of the domain controller that is stored in the AD. This can then be used to obtain domain admin credentials and then restore the original DC password.
Successful exploitation allow the attacker to alter additional credentials, escalate to the level of a domain admin, and move laterally to other machines in the domain and deploy other malware on the compromised networks.
Solution
Apply appropriate patches as mentioned in the Microsoft Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
Vendor Information
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
References
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
Secura
https://www.secura.com/pathtoimg.php?id=2055
CISA
https://cyber.dhs.gov/ed/20-04/
GitHub
https://github.com/SecuraBV/CVE-2020-1472
CVE Name
CVE-2020-1472
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|