"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934

Published: 2021-07-21
Last Updated: 2021-07-22 13:01:54 UTC
by Johannes Ullrich (Version: 1)
3 comment(s)

[UPDATE] Microsoft updated its article late yesterday (Wed July 21st). It now includes a list of vulnerable systems. Most notably, Windows Server, version 20H2 (Server Core Installation) and Windows Server, version 2004 (Server Core installation), Window Server 2019 (Server Core Installation, and "not Core). are affected. Earlier notes did not include any server operating systems.

SANS has scheduled a lightning Talk about the "Summer of SAMS" vulnerability featuring Jeff McJunkin for 5 pm ET on Thursday, July 22nd. Register here: https://www.sans.org/webcasts/what-to-know-about-microsofts-registry-flaw-serioussam-local-privilege-escalation


Microsoft released a knowledge base article regarding CVE-2021-36934 [1]. Bojan yesterday explained the vulnerability in more detail. Recent versions of Microsoft Windows expose several system files due to overly permissive access control lists. Of main interest is the Security Accounts Manager (SAM), which exposes password hashes. It has been demonstrated how this can easily be exploited by retrieving these files from shadow volumes.

Microsoft recommends to:

  • restrict access to %windir%\system32\config
  • delete shadow copies

Deleting shadow copies will of course affect any attempts to restore a prior system state. A new shadow copy may be created after the old copies are deleted and the permissions are adjusted.

Windows 10 1809 and newer are affected. This includes the Windows 11 Beta. Server versions of Windows are not affected. But Microsoft also states that they are still investigating which versions are affected.

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu

3 comment(s)


How can we check on a mass scale if our systems are vulnerable? Also what would be the registry settings to modify via Group Policy to make the changes, again on a mass scale?
From the CERT advisory, it appears you could run

icacls %windir%\system32\config\sam

on each system and check the %errorlevel% to see if it comes back 0 (vulnerable) or non-zero (not vulnerable), or grok the string output for 'access denied' (not vulnerable).
Is this bug that much of a problem to delete all our backups? In our intranet there are barely any local admin accounts, everything is managed via AD. On the other hand, I read that it is possible to exfil cached AD admin creds from security.bak. What are your thoughts on this?

Diary Archives