Netlogon elevation of privilege vulnerability (CVE-2020-1472)
Alert on a critical Microsoft Active Directory vulnerability that could allow unauthenticated attackers to gain administrative credentials.
High alert rating
A high alert is a cyber security vulnerability where people should act quickly (within 48 hours). There are generally no mitigating factors available, and the impact is widespread amongst customers. Impacts are estimated to be lower than a critical alert. High alerts refer to vulnerabilities that might affect Australia.
Proof of concept code to exploit the vulnerability is now freely available online and has been integrated into common exploit frameworks and tools.
CVE-2020-1472 also affects several other products not previously covered by the advisory including, but not limited to:
- Samba implementations on Linux systems prior to v4.8. This includes all Linux distributions that utilise the official Samba packages.
In most cases, CVE-2020-1472 is a privilege escalation vulnerability. However, adversaries may be able exploit the vulnerability for initial access if a Domain Controller is internet-exposed.