^{CVE-2021-36942:}Windows LSA Spoofing Vulnerability (CVE-2021-36942) allows attackers to spoof the Local Security Authority (LSA) to gain unauthorized access to network resources.

Overview

This vulnerability affects the Windows Local Security Authority (LSA) component, which is responsible for authenticating users and enforcing security policies on Windows systems. The flaw allows attackers to spoof LSA and potentially force domain controllers to authenticate to an attacker-controlled server using NTLM authentication. This technique, known as NTLM relay attacks, can be leveraged to compromise Active Directory Certificate Services (AD CS) and potentially gain domain admin privileges. The vulnerability is particularly dangerous as it can be exploited remotely by unauthenticated attackers who can use it to compromise an entire Windows domain.

Remediation

1. Apply the security update released by Microsoft in the August 2021 security updates.
2. Implement NTLM protections such as Extended Protection for Authentication (EPA) and signing features like SMB signing.
3. Configure domain controllers to use secure LDAP connections.
4. Disable NTLM authentication where possible and enforce NTLMv2 responses only.
5. For AD CS environments, configure Certificate Authority (CA) servers to require Kerberos for authentication.
6. Implement network segmentation to limit potential attack vectors.
7. Monitor for suspicious authentication attempts, particularly those involving NTLM.
8. Consider disabling the unprotected NTLM authentication on domain controllers by configuring the "Network security: Restrict NTLM: NTLM authentication in this domain" Group Policy setting.

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942
2. CERT Vulnerability Note VU#405600: https://www.kb.cert.org/vuls/id/405600
3. Microsoft's guidance on mitigating NTLM relay attacks on AD CS: https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429
4. PetitPotam technical analysis by various security researchers
5. NTLM relay attack mitigation guidance from Microsoft