High · published August 12, 2021
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.
🚨 This vulnerability lets attackers impersonate the Local Security Authority (LSA) on Windows systems — like a con artist posing as your trusted building manager! ⚡ Picture a receptionist who can access sensitive areas simply by wearing a fake ID badge. This LSA spoofing flaw allows an attacker to bypass authentication and access network resources as if they were an authorized user. If exploited, attackers could gain full control of the system, read sensitive data, and potentially spread to other connected networks. This is absolutely devastating for any organization, as they could lose sensitive information or face ransomware attacks.
Picture a receptionist who can access sensitive areas simply by wearing a fake ID badge. This LSA spoofing flaw allows an attacker to bypass authentication and access network resources as if they were an authorized user. CVE-2021-36942 is a spoofing vulnerability that allows an attacker to impersonate the LSA, leading to potential unauthorized access to system resources and sensitive data. This flaw affects how security tokens are issued and validated.
If exploited, attackers could gain full control of the system, read sensitive data, and potentially spread to other connected networks. This is absolutely devastating for any organization, as they could lose sensitive information or face ransomware attacks. To protect against this vulnerability, ensure that all Windows systems are updated to the latest security patch from Microsoft. Disable unnecessary services and monitor for unusual activity as well. Don't delay; the sooner you act, the safer you'll be! You've got this! By following these steps, you'll bolster your defenses and secure your systems in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/windows_server_2004 | < 10.0.19041.1165 | 10.0.19041.1165 |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2016 | < 10.0.14393.4583 | 10.0.14393.4583 |
| microsoft/windows_server_2019 | < 10.0.17763.2114 | 10.0.17763.2114 |
| microsoft/windows_server_20h2 | < 10.0.19042.1165 | 10.0.19042.1165 |