Windows 10: Attacks exploiting Netlogon vulnerability (CVE-2020-1472)

Brink · Oct 30, 2020

MSRC / By Aanchal Gupta / October 29, 2020 / Active Directory, EOP, Patch, Standard), vulnerability, Windows Server 2008 R2 Service Pack 1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 all editions, Windows Server version 1809 (Datacenter, Windows Server version 1903 all editions, Windows Server version 1909 all editions

Microsoft has received a small number of reports from customers and others about continued activity exploiting a vulnerability affecting the Netlogon protocol (CVE-2020-1472) which was previously addressed in security updates starting on August 11, 2020. If the original guidance is not applied, the vulnerability could allow an attacker to spoof a domain controller account that could be used to steal domain credentials and take over the domain.

Deploying the August 11, 2020 security update or later release to every domain controller is the most critical first step toward addressing this vulnerability. Once fully deployed, Active Directory domain controller and trust accounts will be protected alongside Windows domain-joined machine accounts. We strongly encourage anyone who has not applied the update to take this step now. Customers need to both apply the update and follow the original guidance as described in KB4557222 to ensure they are fully protected from this vulnerability. We have updated the FAQs in that original guidance from August to provide further clarity.

UPDATE your Domain Controllers with an update released August 11, 2020 or later.

FIND which devices are making vulnerable connections by monitoring event logs.

ADDRESS non-compliant devices making vulnerable connections.

ENABLE enforcement mode to address CVE-2020-1472 in your environment.

Organizations that deploy Microsoft Defender for Identity (previously Azure Advanced Threat Protection) or Microsoft 365 Defender (previously Microsoft Threat Protection) are able to detect adversaries as they try to exploit this specific vulnerability against their domain controllers.

Finally, we have emphasized our previous guidance to relevant government agencies. For example, we contacted the Cybersecurity and Infrastructure Security Agency (CISA) which has issued an additional alert to remind state and local agencies, including those involved in the U.S. elections, about applying steps necessary to address this vulnerability.

Aanchal Gupta
VP Engineering, MSRC
Click to expand...

Source: https://msrc-blog.microsoft.com/2020...cve-2020-1472/

:)

mrdbeta · Oct 30, 2020

Unpatched Microsoft Systems Vulnerable to CVE-2020-0796

Reference Link:- Unpatched Microsoft Systems Vulnerable to CVE-2020-0796 | CISA

Hi

Besides doing the Powershell commands on the terminal.

Is there other methods to do?

I just disable the SMB Direct and Disable the File Sharing through the firewall settings???

Will that do????

DaveCiP · Oct 30, 2020

Patching of CVE-2020-0601

I have a computer that does not list the patch for CVE-2020-060, KB4534293, OS build17134.1246. However, KB4554349 is listed on the same PC, which is OS build 17134.1401. Was the patch for CVE-2020-0601 included in OS build 17134.1401?

JeremyMQ. · Oct 30, 2020

CVE-2020-1425 - Microsoft Windows Codec Library remote Code Execution Vulnerability

CVE-2020-1425 - Microsoft Windows Codec Library remote Code Execution Vulnerability. This is not a patchable vulnerability in Desktop Central. What is required to address this vulnerability?

Windows 10: Attacks exploiting Netlogon vulnerability (CVE-2020-1472)

Attacks exploiting Netlogon vulnerability (CVE-2020-1472)

Attacks exploiting Netlogon vulnerability (CVE-2020-1472)

Attacks exploiting Netlogon vulnerability (CVE-2020-1472)

Attacks exploiting Netlogon vulnerability (CVE-2020-1472) - Similar Threads - Attacks exploiting Netlogon

Netlogon Zerologon CVE-2020-1472 patch for Windows Server 2016/2019

Netlogon Zerologon CVE-2020-1472 patch for Windows Server 2016/2019

Netlogon Zerologon CVE-2020-1472 patch for Windows Server 2016/2019

Microsoft Windows Defender Elevation of Privilege Vulnerability CVE-2020-1163 & CVE-2020-1170

Update Windows Defender now! CVE-2020-1472

Exploit attack - 61003

CVE-2020-1425 and CVE-2020-1457

Unpatched Microsoft Systems Vulnerable to CVE-2020-0796

CVE-2020-0601 Windows CryptoAPI Spoofing Vulnerability Security Vulnerability Published:...