Microsoft: Attackers Exploiting ‘Zero Logon’ Windows Flaw
Summary: Microsoft said on Wednesday that attackers are exploiting CVE-2020-1472, a critical Windows Server flaw dubbed ZeroLogon, days after DHS issued an emergency directive ordering federal agencies to patch by Sept. 21. The flaw, present in Windows Server 2008 through 2019, lets an unauthenticated attacker gain administrative access to a domain controller; Microsoft patched it in August, and malicious SharpZeroLogon.exe samples have been uploaded to VirusTotal.
What's compelling: A compromised domain controller hands an attacker the keys to the kingdom, and DHS expected imminent exploitation because working exploit code was already circulating online before many organizations had finished testing the August patch.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-1472
- Related
- CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, August 2020 Edition Cyber Risks ·Microsoft Patch Tuesday, February 2021 Edition Cyber Risks ·