SB2022051007 - Spoofing attack in Microsoft Windows LSA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022051007

SB2022051007 - Spoofing attack in Microsoft Windows LSA

Published: May 10, 2022

Security Bulletin ID SB2022051007
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2022-26925)

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists within the Windows LSA service. A remote attacker can call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. As a result, an attacker can obtain credentials and compromise the affected system via the NTLM Relay Attack.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References