Microsoft Reminds Organizations of Upcoming Phase in Patching Zerologon Vulnerability

Microsoft this week published a reminder for organizations that a February 9 security update will kick off the second phase of patching for the Zerologon vulnerability.

Tracked as CVE-2020-1472 and addressed on August 2020 Patch Tuesday, the critical vulnerability was identified in the Microsoft Windows Netlogon Remote Protocol (MS-NRPC) and can be abused to compromise Active Directory domain controllers and gain admin access.

Exploitable by unauthenticated attackers able to run a specially crafted application on a device on the network, the vulnerability came into the spotlight in September, after the Department of Homeland Security (DHS) told federal agencies to immediately apply patches for it.

Attacks targeting the vulnerability were observed soon after, and Microsoft issued guidance on how organizations can secure systems affected by the bug. Attacks targeting Zerologon, however, continued.

Microsoft told customers that the patching for this vulnerability would be performed in two stages: the deployment of the August 11 patches, and an enforcement phase set to start on February 9, 2021.

Now, the company reminds organizations of the upcoming transition into the enforcement stage, which will kick off on February 2021 Patch Tuesday.

“We are reminding our customers that beginning with the February 9, 2021 Security Update release we will be enabling Domain Controller enforcement mode by default. This will block vulnerable connections from non-compliant devices,” Microsoft notes.

With the DC enforcement mode enabled, all Windows and non-Windows devices will have to use secure RPC with Netlogon secure channel. However, customers will have the option to add exceptions for non-compliant devices, even if that would render their accounts vulnerable.

In preparation for the enforcement mode phase, organizations should apply the available patch to all domain controllers and should identify and resolve non-compliant devices to ensure they won’t make vulnerable connections.

They can also enable the Domain Controller enforcement mode in their environments prior to the February 9 update.

In a report covering the 2020 threat landscape, Tenable considers Zerologon the top vulnerability of last year, out of 18,358 reported CVEs.

Related: QNAP Issues Advisory on Zerologon Vulnerability

Related: Zerologon Chained With Fortinet, MobileIron Vulnerabilities in U.S. Government Attacks

Related: Microsoft Says Iranian Hackers Exploiting Zerologon Vulnerability