Microsoft Launches Phase 2 Mitigation for Zerologon Flaw

The Netlogon remote code execution vulnerability, disclosed last August, has been weaponized by APT groups.

Microsoft has released phase two mitigation for the critical Zerologon vulnerability disclosed in August 2020. CVE-2020-1472 is an elevation of privilege flaw affecting the Windows Netlogon Remote Protocol (MS-NRPC).
MS-NRPC is a core authentication component of Active Directory. This vulnerability exists when an attacker creates a vulnerable Netlogon secure channel connection to a domain controller using MS-NRPC. With that connection, an attacker doesnt need to authenticate in order to elevate their privileges and become an administrator. An unauthenticated attacker could use this access to run arbitrary code on affected Windows domain controllers.
Concerns about Zerologon quickly escalated after Microsoft issued
the first part
of its mitigation in August. In mid-September, publicly available exploit code was discovered. Shortly after, the DHS Cybersecurity and Infrastructure Security Agency (CISA)
issued an emergency directive
requiring federal agencies to mitigate the flaw by midnight on Sept. 21.
It didnt take long for advanced attackers to add Zerologon to their toolkits. In October 2020, Iranian APT group Mercury was seen using the vulnerability in a series of attacks that Microsoft detected.
Now Microsoft has released the second of its two-part mitigation.
Starting with the Feb. 9, 2021, security update, Windows Domain Controllers will be placed in enforcement mode. This requires all Windows and non-Windows devices to use secure Remote Procedure Call (RPC) with Netlogon secure channel. This update will block vulnerable connections from noncompliant devices, unless those devices are manually given an exception to allow vulnerable Netlogon secure channel connections.
Read the
CISA alert
and Microsoft
security update
for more details.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Launches Phase 2 Mitigation for Zerologon Flaw