Skip to content
COOEY

EXPOSURES › CVE-2021-36942

CVE-2021-36942

CRITICAL ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2021-11-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2021-36942 ↗
⌖ EXPLOITED IN THE WILD SHAME 80/100 ransomwareexploited-in-wild

A Microsoft Windows vulnerability allowed attackers to spoof the Local Security Authority and force domain controllers to authenticate against malicious servers using NTLM.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

DESCRIPTION

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

SENTIMENT · TRUSTED SOURCES
synthesis severe-fallout -0.70
Microsoft's handling of the CVE-2021-36942 vulnerability was met with criticism, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) highlighting its exploitation in known exploited
cooey ↗ severe-fallout -1.00
negative
"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM."
CISA ↗ severe-fallout -1.00
negative
"Known Exploited Vulnerabilities Catalog | CISA"
learn.microsoft.com ↗ severe-fallout -1.00
negative
"Security Advisories and Bulletins | Microsoft Learn"
www.prosec-networks.com ↗ severe-fallout -1.00
negative
"Petit Potam - NTLM Relay Attack | More knowledge with ProSec GmbH"
www.microsoft.com ↗ severe-fallout -1.00
neutral
"The Microsoft Exploitability Index helps customers prioritize security update deployment by providing information on the likelihood that a vulnerability addressed in a Microsoft security update will be exploited."
www.csoonline.com ↗ severe-fallout -1.00
negative
"A new SharePoint vulnerability is already being exploited | CSO Online"
www.rapid7.com ↗ severe-fallout -1.00
negative
"Investigating a SharePoint Compromise: IR Tales from the Field | Rapid7 Blog"
AFFECTED FEDRAMP PRODUCTS · 4
PRODUCTSTATUS
Azure Commercial Cloud
Microsoft
Authorized
Azure Government (includes Dynamics 365)
Microsoft
Authorized
Microsoft Office 365 GCC High
Microsoft
In Process
Office 365 Multi-Tenant & Supporting Services
Microsoft
Authorized