PT-2016-2584 · Microsoft · Netlogon+4

Published 2016-08-09 · Updated 2019-05-15 · CVE-2016-3300

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1 Microsoft Windows Server versions 2012 Gold and R2 Microsoft Windows RT versions 8.1

Description The issue is related to the improper establishment of secure communications channels by the Netlogon service, allowing local users to gain privileges by leveraging access to a domain-joined machine. This can enable an attacker to elevate their privileges.

Recommendations For Microsoft Windows 8.1, consider restricting access to the Netlogon service until a patch is available. For Microsoft Windows Server 2012 Gold and R2, restrict access to the Netlogon service to minimize the risk of exploitation. For Microsoft Windows RT 8.1, avoid using the Netlogon service in domain-joined machines until the issue is resolved.

Fix

LPE

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-01976

CVE-2016-3300

Affected Products

Netlogon

Windows

Windows 8.1

Windows Rt 8.1

Windows Server 2012

References · 9

• https://bdu.fstec.ru/vul/2016-01976 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3300 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3300 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-101 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3300 · Security Note
• http://securityfocus.com/bid/92296 · Note
• https://technet.microsoft.com/library/security/ms16-101 · Note
• http://securitytracker.com/id/1036576 · Note