February Trending CVEs: CVE-2020-1472

As stewards of the lush and vast landscape of security vulnerabilities, we felt obliged to share with you the top trending CVEs of the past month (who's excited for winter to be over?! 😁☀️🌷). Brace yourself! Ok, here we go.

CVE-2020-1472

Technical Background 

On August 11, 2020, Microsoft released a security update that includes a patch for a severe vulnerability in the NETLOGON protocol CVE-2020-1472. Since no primary technical information was published, the CVE failed to get much attention even though it received a maximum CVSS score of 10.

This vulnerability allows an unauthenticated attacker to access a domain controller, establish a vulnerable Netlogon session, and gain domain administrator privileges. 

The vulnerability is critical because the major requirement for a successful exploit is the ability to establish a connection with a domain controller.

Exploit Steps Overview  

• Establish an unsecure Netlogon channel against a domain controller by performing a brute-force attack using an 8 zero-bytes challenge and ciphertext, while tricking the identity of that same domain controller. 
• Use the NetrServerPasswordSet2 call to set the domain controller account’s password, as stored in Active Directory, to an empty one. This breaks some of the domain controller functionality since the password stored in the domain controller’s registry does not change.
• Use the empty password to connect to that same domain controller and dump additional hashes by using the Domain Replication Service (DRS) protocol.
• Revert the domain controller password to the original one as stored in the local registry to avoid detection.
• Exploit the hashes dumped from stage 3 to perform any preferred attack.

Solution

Applying the Patch Tuesday update from Microsoft’s Advisory will fix the vulnerability. It enforces a remote procedure call (RPC) in the Netlogon protocol for all Windows devices. Microsoft made a revision to this advisory in February.

Visit the Vicarius Research Center for more information on CVEs and how to remediate them. You can also try a 30-day free trial of our TOPIA solution.

Prefer to listen instead? We got you covered 😏