CVE-2021-36942 : Windows LSA Spoofing Vulnerability

Products affected by CVE-2021-36942

Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
Matching versions
Microsoft » Windows Server 2012 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: R2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2016
Versions before (<) 10.0.14393.4583
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019
Versions before (<) 10.0.17763.2114
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2004
Versions before (<) 10.0.19041.1165
cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 20h2
Versions before (<) 10.0.19042.1165
cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*
Matching versions

CVE-2021-36942 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2021-36942

Added on 2021-11-03 Action due date 2021-11-17

Exploit prediction scoring system (EPSS) score for CVE-2021-36942

EPSS FAQ

83.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2021-36942

PetitPotam

First seen: 2022-12-23

auxiliary/scanner/dcerpc/petitpotam

Coerce an authentication attempt over SMB to other machines via MS-EFSRPC methods. Authors: - GILLES Lionel - Spencer McIntyre

More information

CVSS scores for CVE-2021-36942

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST	2024-07-26
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	Microsoft Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2021-36942

https://www.kb.cert.org/vuls/id/405600

VU#405600 - Microsoft Windows Active Directory Certificate Services can allow for AD compromise via PetitPotam NTLM relay attacks
Exploit;Third Party Advisory;US Government Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942

CVE-2021-36942 - Security Update Guide - Microsoft - Windows LSA Spoofing Vulnerability
Patch;Vendor Advisory