28 lines
962 B
YAML
28 lines
962 B
YAML
cve: CVE-2020-1472
|
|
alias: Zerologon — Netlogon AES-CFB8 all-zero IV
|
|
cwe_primary: CWE-330
|
|
cwe_acceptable: [CWE-330, CWE-326, CWE-1204, CWE-327, CWE-310, CWE-339]
|
|
target_file: source.c
|
|
vuln_lines: [37, 38, 39, 40, 41, 42, 43]
|
|
severity: critical
|
|
vuln_class: weak_cryptography
|
|
exploit_pattern_regex: '(memset.*iv.*0|iv\s*=\s*\{?\s*0|all[-\s]?zero|brute[-\s]?force)'
|
|
must_mention_any:
|
|
- all-zero
|
|
- fixed iv
|
|
- cfb8
|
|
- brute force
|
|
- authentication bypass
|
|
- 1/256
|
|
- weak cryptography
|
|
- predictable
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: compute_netlogon_credential uses an ALL-ZERO IV with AES-CFB8.
|
|
Combined with attacker control of client_challenge and the 1/256 probability
|
|
of a zero-collapsing session key, this allows authentication bypass.
|
|
Hunter MUST identify:
|
|
1. The IV is hard-coded zero (memset to 0).
|
|
2. CFB8 with controlled plaintext and predictable IV is exploitable.
|
|
3. Bypass results in arbitrary Netlogon authentication.
|