Security Experts:

Connect with us

Hi, what are you looking for?


Incident Response

Microsoft Reminds Organizations of Upcoming Phase in Patching Zerologon Vulnerability

Microsoft this week published a reminder for organizations that a February 9 security update will kick off the second phase of patching for the Zerologon vulnerability.

Microsoft this week published a reminder for organizations that a February 9 security update will kick off the second phase of patching for the Zerologon vulnerability.

Tracked as CVE-2020-1472 and addressed on August 2020 Patch Tuesday, the critical vulnerability was identified in the Microsoft Windows Netlogon Remote Protocol (MS-NRPC) and can be abused to compromise Active Directory domain controllers and gain admin access.

Exploitable by unauthenticated attackers able to run a specially crafted application on a device on the network, the vulnerability came into the spotlight in September, after the Department of Homeland Security (DHS) told federal agencies to immediately apply patches for it.

Attacks targeting the vulnerability were observed soon after, and Microsoft issued guidance on how organizations can secure systems affected by the bug. Attacks targeting Zerologon, however, continued.

Microsoft told customers that the patching for this vulnerability would be performed in two stages: the deployment of the August 11 patches, and an enforcement phase set to start on February 9, 2021.

Now, the company reminds organizations of the upcoming transition into the enforcement stage, which will kick off on February 2021 Patch Tuesday.

“We are reminding our customers that beginning with the February 9, 2021 Security Update release we will be enabling Domain Controller enforcement mode by default. This will block vulnerable connections from non-compliant devices,” Microsoft notes.

With the DC enforcement mode enabled, all Windows and non-Windows devices will have to use secure RPC with Netlogon secure channel. However, customers will have the option to add exceptions for non-compliant devices, even if that would render their accounts vulnerable.

In preparation for the enforcement mode phase, organizations should apply the available patch to all domain controllers and should identify and resolve non-compliant devices to ensure they won’t make vulnerable connections.

They can also enable the Domain Controller enforcement mode in their environments prior to the February 9 update.

In a report covering the 2020 threat landscape, Tenable considers Zerologon the top vulnerability of last year, out of 18,358 reported CVEs.

Related: QNAP Issues Advisory on Zerologon Vulnerability

Related: Zerologon Chained With Fortinet, MobileIron Vulnerabilities in U.S. Government Attacks

Related: Microsoft Says Iranian Hackers Exploiting Zerologon Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Management & Strategy

Tens of cybersecurity companies have announced cutting staff over the past year, in some cases significant portions of their global workforce.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.