Read the docs
TI-2020-01431 Aliases CVE-2020-1472GHSA-gc5h-xf3g-h5x4

Netlogon Elevation of Privilege Vulnerability

Priority CRITICAL 100Exploited in the wildPublished · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 13 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03Known ransomware use
EPSS 0.99389 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Windows Server version 2004 (Microsoft): publicationWindows Server 2019 (Microsoft): publication+12 more productsRed Hat: 3 advisoriesRed Hat: 13 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows Server version 200410.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 201910.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2019 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server, version 1909 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server, version 1903 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 201610.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2016 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2008 R2 Service Pack 16.1.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)6.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 20126.2.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2012 (Server Core installation)6.2.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2012 R26.3.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2012 R2 (Server Core installation)6.3.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server version 20H210.0.0 to before publicationpublicationPatch availableCNA
  • Windows Server version 2004 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2019 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server, version 1909 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server, version 1903 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2016 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2016 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2008 R2 Service Pack 1 VendorMicrosoft Affected 6.1.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation) VendorMicrosoft Affected 6.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2012 VendorMicrosoft Affected 6.2.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2012 (Server Core installation) VendorMicrosoft Affected 6.2.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2012 R2 VendorMicrosoft Affected 6.3.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2012 R2 (Server Core installation) VendorMicrosoft Affected 6.3.0 to before publication Fixed in publication Patch available CNA
  • Windows Server version 20H2 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*r2 sp1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
  • cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2004:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_20h2:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:synology:directory_server:*:*:*:*:*:*:*:*before 4.4.5-0101VulnerableSynology
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*before 4.10.18; 4.11.0 to before 4.11.13; 4.12.0 to before 4.12.7VulnerableSamba
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*8.8VulnerableOracle
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:synology:directory_server:*:*:*:*:*:*:*:* Versions before 4.4.5-0101 Vulnerable ·Synology
  • cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* Versions before 4.10.18; 4.11.0 to before 4.11.13; 4.12.0 to before 4.12.7 Vulnerable ·Samba
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle

Remediation

  • Fix · CNA Windows Server version 2004 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2019 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2019 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server, version 1909 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server, version 1903 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2016 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2016 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2008 R2 Service Pack 1 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2008 R2 Service Pack 1 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2012 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2012 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2012 R2 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2012 R2 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows Server version 20H2 (Microsoft) Fixed in publication

Red Hat 3 advisories

  • RHSA-2021:3723 Released 2021-10-05 · Red Hat rating Moderate
    samba security, bug fix and enhancement update
    • Red Hat Gluster 3.5 Samba on RHEL-7 ctdb-4.11.6-112.el7rhgs, libsmbclient-4.11.6-112.el7rhgs, libsmbclient-devel-4.11.6-112.el7rhgs +18
  • RHSA-2021:1647 Released 2021-05-18 · Red Hat rating Moderate
    samba security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) libsmbclient-devel-4.13.3-3.el8, libwbclient-devel-4.13.3-3.el8, samba-devel-4.13.3-3.el8
    • Red Hat Enterprise Linux AppStream (v. 8) openchange-2.3-27.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) ctdb-4.13.3-3.el8, ctdb-tests-4.13.3-3.el8, libsmbclient-4.13.3-3.el8 +19
  • RHSA-2020:5439 Released 2020-12-15 · Red Hat rating Moderate
    samba security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) libsmbclient-4.10.16-9.el7_9, libwbclient-4.10.16-9.el7_9, samba-4.10.16-9.el7_9 +10
    • Red Hat Enterprise Linux Client Optional (v. 7) libsmbclient-devel-4.10.16-9.el7_9, libwbclient-devel-4.10.16-9.el7_9, samba-4.10.16-9.el7_9 +10
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libsmbclient-devel-4.10.16-9.el7_9, libwbclient-devel-4.10.16-9.el7_9, samba-4.10.16-9.el7_9 +11
    • Red Hat Enterprise Linux Server (v. 7) libsmbclient-4.10.16-9.el7_9, libsmbclient-4.10.16-9.el7_9.ppc, libwbclient-4.10.16-9.el7_9 +17
    • Red Hat Enterprise Linux Server Optional (v. 7) libsmbclient-devel-4.10.16-9.el7_9, libsmbclient-devel-4.10.16-9.el7_9.ppc, libwbclient-devel-4.10.16-9.el7_9 +14
    • Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb-4.10.16-9.el7_9, ctdb-tests-4.10.16-9.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) libsmbclient-4.10.16-9.el7_9, libwbclient-4.10.16-9.el7_9, samba-4.10.16-9.el7_9 +11
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libsmbclient-devel-4.10.16-9.el7_9, libwbclient-devel-4.10.16-9.el7_9, samba-dc-4.10.16-9.el7_9 +8

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2021:1647
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:1647
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2021:1647
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux Server Resilient Storage (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5439
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:5439
Red Hat Gluster 3.5 Samba on RHEL-7Fixed RHSA-2021:3723
Red Hat Gluster 3.5 Samba on RHEL-8Fixed—

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2020-1472
  3. 2026-10-03 Alias added: GHSA-gc5h-xf3g-h5x4

References

Exploit 1

Patch 2

Advisory 14

  • TI-2020-00771 Memory corruption in Microsoft Windows 10 Version 1903 for 32-bit Systems KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-00989 Out-of-bounds write in Microsoft Windows KEVCVSS 3.1HIGH 8.8
  • TI-2019-00654 A remote code execution vulnerability exists in the way that the Windows Graphics Device… KEVCVSS 3.1HIGH 8.8
  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2020-01423 Windows Spoofing Vulnerability KEVCVSS 3.1HIGH 7.8
  • TI-2020-01023 Win32k Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences