{"timestamp":"2024-01-30T18:45:11.261978Z","id":"CVE-2020-1472","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Microsoft","product":"Windows Server version 2004","cpes":["cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server 2019","cpes":["cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server 2019 (Server Core installation)","cpes":["cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server, version 1909 (Server Core installation)","cpes":["cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server, version 1903 (Server Core installation)","cpes":["cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server 2016","cpes":["cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server 2016 (Server Core installation)","cpes":["cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*"],"platforms":["x64-based Systems"],"versions":[{"version":"10.0.0","lessThan":"publication","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Windows Server 2008 R2 Service Pack 1","cpes":["cpe:2.3:o:microsoft:window

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

2020-09-21

2022-05-03

CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472 Types: US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472

NVD-CWE-noinfo

CWE-330

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html

http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html

http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html

http://www.openwall.com/lists/oss-security/2020/09/17/2

https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472

https://security.gentoo.org/glsa/202012-24

https://usn.ubuntu.com/4510-1/

https://usn.ubuntu.com/4510-2/

https://usn.ubuntu.com/4559-1/

https://www.kb.cert.org/vuls/id/490028

https://www.oracle.com/security-alerts/cpuApr2021.html

https://www.synology.com/security/advisory/Synology_SA_20_21

OR
 *cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
 *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

OR
 *cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
 *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ No Types Assigned

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ No Types Assigned

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ No Types Assigned

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ Mailing List, Third Party Advisory

<p>An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (<a href="https://docs.microsoft.com/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f">MS-NRPC</a>). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.</p>
<p>To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.</p>
<p>Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.</p>
<p>For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see <a href="https://support.microsoft.com/kb/4557222">How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472</a> (updated September 28, 2020).</p>
<p>When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See <a href="https://technet.microsoft.com/en-us/security/dd252948">Microsoft Technical Security Notifications</a>.</p>

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.

<p>An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (<a href="https://docs.microsoft.com/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f">MS-NRPC</a>). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.</p>
<p>To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.</p>
<p>Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.</p>
<p>For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see <a href="https://support.microsoft.com/kb/4557222">How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472</a> (updated September 28, 2020).</p>
<p>When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See <a href="https://technet.microsoft.com/en-us/security/dd252948">Microsoft Technical Security Notifications</a>.</p>

Microsoft Corporation AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Microsoft Corporation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ [No types assigned]

Microsoft Corporation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ [No types assigned]

Microsoft Corporation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ [No types assigned]

Microsoft Corporation https://lists.fedoraproject.org/archives/list/[email protected]/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/

Microsoft Corporation https://lists.fedoraproject.org/archives/list/[email protected]/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/

Microsoft Corporation https://lists.fedoraproject.org/archives/list/[email protected]/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/

OR
 *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

OR
 *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

OR
 *cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
 *cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

OR
 *cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
 *cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
 *cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

OR
 *cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

OR
 *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html No Types Assigned

http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry

https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html No Types Assigned

https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ No Types Assigned

https://lists.fedoraproject.org/archives/list/[email protected]/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ Mailing List, Third Party Advisory

https://security.gentoo.org/glsa/202012-24 No Types Assigned

https://security.gentoo.org/glsa/202012-24 Third Party Advisory

https://usn.ubuntu.com/4559-1/ No Types Assigned

https://usn.ubuntu.com/4559-1/ Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html No Types Assigned

https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory

CWE-269

CWE-330

https://www.oracle.com/security-alerts/cpuApr2021.html [No Types Assigned]

https://security.gentoo.org/glsa/202012-24 [No Types Assigned]

https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html [No Types Assigned]

http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html [No Types Assigned]

https://usn.ubuntu.com/4559-1/ [No Types Assigned]

https://lists.fedoraproject.org/archives/list/[email protected]/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ [No Types Assigned]

OR
 *cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* versions up to (excluding) 4.10.18
 *cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* versions from (including) 4.11.0 up to (excluding) 4.11.13
 *cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* versions from (including) 4.12.0 up to (excluding) 4.12.7

OR
 *cpe:2.3:a:synology:directory_server:*:*:*:*:*:*:*:* versions up to (excluding) 4.4.5-0101

OR
 *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

OR
 *cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
 *cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

OR
 *cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
 *cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html Mailing List, Third Party Advisory

http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html No Types Assigned

http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html Third Party Advisory, VDB Entry

http://www.openwall.com/lists/oss-security/2020/09/17/2 No Types Assigned

http://www.openwall.com/lists/oss-security/2020/09/17/2 Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ No Types Assigned

https://lists.fedoraproject.org/archives/list/[email protected]/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ No Types Assigned

https://lists.fedoraproject.org/archives/list/[email protected]/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ Third Party Advisory

https://usn.ubuntu.com/4510-1/ No Types Assigned

https://usn.ubuntu.com/4510-1/ Third Party Advisory

https://usn.ubuntu.com/4510-2/ No Types Assigned

https://usn.ubuntu.com/4510-2/ Third Party Advisory

https://www.kb.cert.org/vuls/id/490028 No Types Assigned

https://www.kb.cert.org/vuls/id/490028 Third Party Advisory, US Government Resource

https://www.synology.com/security/advisory/Synology_SA_20_21 No Types Assigned

https://www.synology.com/security/advisory/Synology_SA_20_21 Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html [No Types Assigned]

https://lists.fedoraproject.org/archives/list/[email protected]/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ [No Types Assigned]

https://usn.ubuntu.com/4510-2/ [No Types Assigned]

https://www.synology.com/security/advisory/Synology_SA_20_21 [No Types Assigned]

https://usn.ubuntu.com/4510-1/ [No Types Assigned]

http://www.openwall.com/lists/oss-security/2020/09/17/2 [No Types Assigned]

https://www.kb.cert.org/vuls/id/490028 [No Types Assigned]

http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html [No Types Assigned]

NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NIST (AV:N/AC:M/Au:N/C:C/I:C/A:C)

NIST CWE-269

OR
 *cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
 *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
 *cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 No Types Assigned

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 Patch, Vendor Advisory