Windows Netlogon Remote Protocol News Today : Breaking News, Live Updates & Top Stories | Vimarsana

CVE-2020-1472 is a privilege escalation flaw that allows an attacker to take over an organization's domain controllers.

Several artifacts from recent attacks strongly suggest a connection between the two operations, researchers say.

A first phase patch for the critical vulnerability, tracked as CVE-2020-1472, was issued in August 2020. "The first phase of the patch was intended to address the vulnerability on two fronts: blocking both Windows-based domain members and non-Windows PCs that have been configured to disable signing/encryption as well as making changes to the Netlogon protocol for clients that cannot use the required signing/encryption," says Satnam Narang, staff research engineer at the security firm Tenable. The second patch completes the patching process for those who did not earlier implement enforcement ...

This move will block vulnerable connections from noncompliant devices, according to a Microsoft Security and Response Center blog post. DC enforcement mode requires both Windows and non-Windows devices to use secure Remote Procedure Call (RPC) with a Netlogon secure channel, unless a business has allowed an account to be exposed by adding an exception for a noncompliant device.  CVE-2020-1472 is a privilege escalation flaw in the Windows Netlogon Remote Protocol (MS-NRPC) with a CVSS score of 10. It could enable an unauthenticated attacker to use MS-NRPC to connect to a domain controller and...

By Egon Rinderer Dec 15, 2020 Zerologon is one of the most significant vulnerabilities to surface in a long time. Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) released a notice stating the Zerologon vulnerability poses an “unacceptable risk” to the federal civilian executive branch, and required that all federal agencies “immediately apply the Windows Server August 2020 security update” or disconnect from federal networks. Zerologon allows devices to authenticate to the domain controller and update their password in the Active Directory (AD). Zerologo...