Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: "Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934 SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
"Summer of SAM": Microsoft Releases Guidance for CVE-2021-36934

[UPDATE] Microsoft updated its article late yesterday (Wed July 21st). It now includes a list of vulnerable systems. Most notably, Windows Server, version 20H2 (Server Core Installation) and Windows Server, version 2004 (Server Core installation), Window Server 2019 (Server Core Installation, and "not Core). are affected. Earlier notes did not include any server operating systems.

SANS has scheduled a lightning Talk about the "Summer of SAMS" vulnerability featuring Jeff McJunkin for 5 pm ET on Thursday, July 22nd. Register here: https://www.sans.org/webcasts/what-to-know-about-microsofts-registry-flaw-serioussam-local-privilege-escalation

----

Microsoft released a knowledge base article regarding CVE-2021-36934 [1]. Bojan yesterday explained the vulnerability in more detail. Recent versions of Microsoft Windows expose several system files due to overly permissive access control lists. Of main interest is the Security Accounts Manager (SAM), which exposes password hashes. It has been demonstrated how this can easily be exploited by retrieving these files from shadow volumes.

Microsoft recommends to:

  • restrict access to %windir%\system32\config
  • delete shadow copies

Deleting shadow copies will of course affect any attempts to restore a prior system state. A new shadow copy may be created after the old copies are deleted and the permissions are adjusted.

Windows 10 1809 and newer are affected. This includes the Windows 11 Beta. Server versions of Windows are not affected. But Microsoft also states that they are still investigating which versions are affected.

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

I will be teaching next: Defending Web Applications Security Essentials - SANS Cyber Defense Initiative 2021

Johannes

4307 Posts
ISC Handler
Jul 22nd 2021
How can we check on a mass scale if our systems are vulnerable? Also what would be the registry settings to modify via Group Policy to make the changes, again on a mass scale?
AAInfoSec

50 Posts
From the CERT advisory, it appears you could run

icacls %windir%\system32\config\sam

on each system and check the %errorlevel% to see if it comes back 0 (vulnerable) or non-zero (not vulnerable), or grok the string output for 'access denied' (not vulnerable).
Paul

47 Posts
Is this bug that much of a problem to delete all our backups? In our intranet there are barely any local admin accounts, everything is managed via AD. On the other hand, I read that it is possible to exfil cached AD admin creds from security.bak. What are your thoughts on this?
Jack

8 Posts

Sign Up for Free or Log In to start participating in the conversation!