CVE-2020-1472

Scores

EPSS

0.944High94.4%
0%20%40%60%80%100%

Percentile: 94.4%

CVSS

9.8Critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debianmsrcnvdredhatubuntu

CWEs

CWE-287CWE-330

Related Vulnerabilities

Exploits

Exploit ID: 49071

Source: exploitdb

URL: https://www.exploit-db.com/exploits/49071

Recommendations

Source: nvd

Apply an updateOn August 11, 2020, Microsoft issued an advisory that provides updates for this vulnerability.Enable secure RPC enforcement modeThe August 2020 updates for CVE-2020-1472 include changes to domain controllers that can optionally be enabled to require secure RPC for Netlogon secure channel connections. The changes to require secure RPC must be made to receive the most complete protection from this vulnerability. For systems that have the August 2020 update for CVE-2020-1472, enabling secure RPC enforcement mode will change domain controller behavior to require Netlogon secure channel connections using secure MS-NRPC. This change to enable enforcement mode will be deployed automatically on or after February 9, 2021.

URL: https://www.kb.cert.org/vuls/id/490028

Vulnerable Software (41)

Type: Configuration

Product: openchange

Operating System: rhel

Trait:
{
  "fixed": "2.3-27.el8"
}

Source: redhat

Type: Configuration

Product: openchange

Operating System: rhel 8

Trait:
{
  "fixed": "2.3-27.el8"
}

Source: redhat

Type: Configuration

Product: samba

Operating System: ubuntu focal 20.04

Trait:
{
  "unaffected": true
}

Source: ubuntu

Type: Configuration

Product: samba

Operating System: ubuntu trusty 14.04

Trait:
{
  "unfixed": true
}

Source: ubuntu

Type: Configuration

Product: samba

Operating System: ubuntu xenial 16.04

Trait:
{
  "fixed": "2:4.3.11+dfsg-0ubuntu0.16.04.30"
}

Source: ubuntu

Type: Configuration

Product: samba

Operating System: rhel 7

Trait:
{
  "fixed": "4.10.16-9.el7_9"
}

Source: redhat

Type: Configuration

Product: samba

Operating System: rhel

Trait:
{
  "fixed": "4.13.3-3.el8"
}

Source: redhat

Type: Configuration

Product: samba

Operating System: rhel 8

Trait:
{
  "fixed": "4.13.3-3.el8"
}

Source: redhat

Type: Configuration

Product: samba

Operating System: rhel

Trait:
{
  "fixed": "4.11.6-112.el7rhgs"
}

Source: redhat

Type: Configuration

Product: samba

Operating System: rhel

Trait:
{
  "fixed": "4.13.7-101.el8rhgs"
}

Source: redhat