|
[UPDATE] Microsoft updated its article late yesterday (Wed July 21st). It now includes a list of vulnerable systems. Most notably, Windows Server, version 20H2 (Server Core Installation) and Windows Server, version 2004 (Server Core installation), Window Server 2019 (Server Core Installation, and "not Core). are affected. Earlier notes did not include any server operating systems. SANS has scheduled a lightning Talk about the "Summer of SAMS" vulnerability featuring Jeff McJunkin for 5 pm ET on Thursday, July 22nd. Register here: https://www.sans.org/webcasts/what-to-know-about-microsofts-registry-flaw-serioussam-local-privilege-escalation ---- Microsoft released a knowledge base article regarding CVE-2021-36934 [1]. Bojan yesterday explained the vulnerability in more detail. Recent versions of Microsoft Windows expose several system files due to overly permissive access control lists. Of main interest is the Security Accounts Manager (SAM), which exposes password hashes. It has been demonstrated how this can easily be exploited by retrieving these files from shadow volumes. Microsoft recommends to:
Deleting shadow copies will of course affect any attempts to restore a prior system state. A new shadow copy may be created after the old copies are deleted and the permissions are adjusted. Windows 10 1809 and newer are affected. This includes the Windows 11 Beta. Server versions of Windows are not affected. But Microsoft also states that they are still investigating which versions are affected. [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 --- |
Johannes 4308 Posts ISC Handler Jul 22nd 2021 |
| Thread locked Subscribe |
Jul 22nd 2021 4 months ago |
|
How can we check on a mass scale if our systems are vulnerable? Also what would be the registry settings to modify via Group Policy to make the changes, again on a mass scale?
|
AAInfoSec 50 Posts |
| Quote |
Jul 21st 2021 4 months ago |
|
From the CERT advisory, it appears you could run
icacls %windir%\system32\config\sam on each system and check the %errorlevel% to see if it comes back 0 (vulnerable) or non-zero (not vulnerable), or grok the string output for 'access denied' (not vulnerable). |
Paul 47 Posts |
| Quote |
Jul 21st 2021 4 months ago |
|
Is this bug that much of a problem to delete all our backups? In our intranet there are barely any local admin accounts, everything is managed via AD. On the other hand, I read that it is possible to exfil cached AD admin creds from security.bak. What are your thoughts on this?
|
Jack 8 Posts |
| Quote |
Jul 22nd 2021 4 months ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
