Threat Source newsletter for Oct. 8, 2020

Summary: Cisco Talos reported a spike in exploitation attempts against CVE-2020-1472, an elevation-of-privilege flaw in Netlogon's cryptographic authentication scheme that lets attackers forge an authentication token and impersonate any computer, including the domain controller, to gain domain admin credentials. Cisco also patched several IOS vulnerabilities, many rated severe, including CVE-2020-3421 and CVE-2020-3480 in Zone-Based Firewall that could force a device to reload or stop forwarding traffic.
Key Takeaway: A flaw that yields domain admin credentials is being exploited at a rising rate, so an unpatched Netlogon path hands an attacker the keys to the domain rather than a single machine.

Read the original at Cisco Talos ↗

Topics: Malware
Mentions: CVE-2020-1472
Related: CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Microsoft Patch Tuesday for Aug. 2020 — Snort rules and prominent vulnerabilities Cyber Risks ·
Microsoft Netlogon exploitation continues to rise Cyber Risks ·