An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.
To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.
For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).
When the second phase of Windows updates become available in Q1 2021, customers
Connections 29
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server version 20045a54a266-4fe7-446e-9dfd-09ddfd7ed985
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 20161edd8472-fee6-4c2b-a353-ce4f3696a3e0
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server, version 1903 (Server Core installation)dc186120-db31-4dd0-ae29-9bb30b5cab20
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2008 R2 Service Pack 19641b82a-1943-4d4c-9a09-72bf64a2b5f0
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server, version 1909 (Server Core installation)8311beb0-7194-43e7-8a4a-b033d362973f
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 20127d639a85-68ea-4e18-a1a5-92564900e2d2
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2012 (Server Core installation)ab2b33b8-524e-4bf4-a11b-c07a6e068638
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server version 20H278c24efe-bd8e-4cf5-b318-b28247ee4776
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2016 (Server Core installation)5ea48afb-358e-43a3-8df4-233ae3baafb7
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2012 R2 (Server Core installation)6aa4a48f-f395-4c44-9e50-17c9a810c0ac
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)f73971ef-fa9a-4499-8394-48fa4c4be3b2
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 20195162781c-c8f1-4a4f-8137-466d35718a69
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2012 R20c59ec5b-18b4-4f5d-9bac-97761a1d3919
has cited scope1 retained · stored CVE-2020-1472 → Microsoft · Windows Server 2019 (Server Core installation)e3792466-6411-47b8-9f86-1f7b4163fd2f
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_201638b96686-560c-4f98-8139-62c48d6cefb0
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_190949507e14-a4f4-444e-8a68-ac0c67407d9a
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_1903d1cd9aee-1860-4266-b894-19ede13e00c8
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_2008b4dca9de-2f34-4e68-a5ca-ed4a344156ad
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_2019b8034219-525e-4b5b-8450-ad9f7f2b3201
has vulnerable target scope1 retained · stored CVE-2020-1472 → debian · debian_linux3b2935e9-fa51-4480-9f95-2849ce5ccb7a
has vulnerable target scope1 retained · stored CVE-2020-1472 → oracle · zfs_storage_appliance_kit233ddc12-52c2-44f9-a131-e66b98bb1be5
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_20h224f60628-e565-4922-81ff-f8a2b83c6940
has vulnerable target scope1 retained · stored CVE-2020-1472 → microsoft · windows_server_20047d68345d-c123-458e-8deb-6457eaa25ba4
has vulnerable target scope2 retained · stored CVE-2020-1472 → microsoft · windows_server_20129a5ef179-ea0e-4401-9e06-e0ad4314ce48b91c76ea-2d7c-44e2-bc86-e830e3facc9e
has vulnerable target scope1 retained · stored CVE-2020-1472 → synology · directory_server7307ec7c-a0d1-4da7-aac5-96269627dfd9
has vulnerable target scope5 retained · stored CVE-2020-1472 → canonical · ubuntu_linux201e03fa-3c69-4cb8-8c00-70432233c8b029ecba4e-9e3b-4db0-8bc2-488b7b023f634682ed05-1dfa-4bfe-9329-714dff573e3e73910daa-6213-44ee-9e6d-2405657f5d9ce38a790d-ba1e-47d6-accc-31fe53ebf30a
has vulnerable target scope3 retained · stored CVE-2020-1472 → samba · samba92a0f614-e3b1-40de-a277-0e06eb4202cde1c70d69-321d-4e15-9f13-a5abb657044ced9f87c6-fd59-45b3-b9eb-4befd46f2793
has vulnerable target scope2 retained · stored CVE-2020-1472 → opensuse · leap1f32426f-eabc-4b3d-b818-8628fe95aea738b84a3c-26ed-4f3a-a43f-527ae47273a4
has vulnerable target scope3 retained · stored CVE-2020-1472 → fedoraproject · fedora1906e3ed-efa8-4365-8776-c5b90fc0deb746289aea-6c9d-440e-8b46-c77e507e2dc5b68c7f6f-4914-42c1-a240-6a5018df839f