"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934

"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934
[UPDATE] Microsoft updated its article late yesterday (Wed July 21st). It now includes a list of vulnerable systems. Most notably, Windows Server, version 20H2 (Server Core Installation) and Windows Server, version 2004 (Server Core installation), Window Server 2019 (Server Core Installation, and "not Core). are affected. Earlier notes did not include any server operating systems. SANS has scheduled a lightning Talk about the "Summer of SAMS" vulnerability featuring Jeff McJunkin for 5 pm ET on Thursday, July 22nd. Register here: https://www.sans.org/webcasts/what-to-know-about-microsofts-registry-flaw-serioussam-local-privilege-escalation ---- Microsoft released a knowledge base article regarding CVE-2021-36934 [1]. Bojan yesterday explained the vulnerability in more detail. Recent versions of Microsoft Windows expose several system files due to overly permissive access control lists. Of main interest is the Security Accounts Manager (SAM), which exposes password hashes. It has been demonstrated how this can easily be exploited by retrieving these files from shadow volumes. Microsoft recommends to: restrict access to %windir%\system32\config delete shadow copies Deleting shadow copies will of course affect any attempts to restore a prior system state. A new shadow copy may be created after the old copies are deleted and the permissions are adjusted. Windows 10 1809 and newer are affected. This includes the Windows 11 Beta. Server versions of Windows are not affected. But Microsoft also states that they are still investigating which versions are affected. [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 --- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter\| I will be teaching next: Intrusion Detection In-Depth - SANS London October 2021	Johannes 4245 Posts ISC Handler Jul 22nd 2021
Thread locked Subscribe	Jul 22nd 2021 2 months ago
How can we check on a mass scale if our systems are vulnerable? Also what would be the registry settings to modify via Group Policy to make the changes, again on a mass scale?	AAInfoSec 50 Posts
Quote	Jul 21st 2021 2 months ago
From the CERT advisory, it appears you could run icacls %windir%\system32\config\sam on each system and check the %errorlevel% to see if it comes back 0 (vulnerable) or non-zero (not vulnerable), or grok the string output for 'access denied' (not vulnerable).	Paul 47 Posts
Quote	Jul 21st 2021 2 months ago
Is this bug that much of a problem to delete all our backups? In our intranet there are barely any local admin accounts, everything is managed via AD. On the other hand, I read that it is possible to exfil cached AD admin creds from security.bak. What are your thoughts on this?	Jack 8 Posts
Quote	Jul 22nd 2021 2 months ago