SmartStateIndia
News

Tenable Advises Enterprises to Patch ZeroLogon and HP Device Manager Vulnerabilities

According to a tweet from Microsoft’s Security Intelligence team, they’ve observed that a nation-state actor has been leveraging CVE-2020-1472, a critical elevation of privilege vulnerability in Netlogon. Researchers named this vulnerability “Zerologon” because of how the exploit abuses the initialisation vectors within the logon process, which are set to zeros rather than being randomly generated.

Please find below a comment from Rody Quinlan, Security Response Manager at Tenable:
“Given the large availability of working proof of concepts (PoCs), and overall impact from exploitation, it’s unsurprising that known groups are looking to take advantage of this Netlogon vulnerability, dubbed Zerologon. Exploitation, if successful, allows the complete takeover of the Windows domain – that’s the virtual equivalent of the keys to the kingdom. A quick search on GitHub reveals that there are currently at least 40 repositories containing PoC code relating to this flaw. There are also working exploit scripts that defenders and attackers alike can utilize to exploit this vulnerability. This is going to be one of the more favourable vulnerabilities this year for malicious parties and it’s imperative that organizations either patch or take remediative action immediately to prevent systems from being compromised.”

HP recently published a security bulletin to address multiple vulnerabilities in HP Device Manager, software that’s used to manage HP Thin Clients remotely. The three vulnerabilities disclosed to HP by security researcher Nick Bloor warned that a combination of these vulnerabilities could allow an attacker to gain remote command execution on the vulnerable system through the HP Device Manager.

Please find below a comment from Satnam Narang, Staff Research Engineer at Tenable. A full analysis of the vulnerabilities is available here.

“HP Device Manager is a popular software solution used to manage HP Thin Clients remotely. The three vulnerabilities disclosed in HP’s recent security bulletin by themselves are notable. However, a pair of the flaws, CVE-2020-6926 and CVE-2020-6927, when combined could allow an attacker to gain remote command execution on the vulnerable system through the HP Device Manager. HP has so far released patches for the 5.0.x branch of HP Device Manager, so organizations using this particular branch release should upgrade to 5.0.4 as soon as possible. If an organization is using a previous version of HP Device Manager, there are mitigation steps in HP’s security bulletin that can be taken to protect against these attacks until a patch becomes available.”

Related posts

Electronics Asia Conference 2023 to Highlight IoT, AI/ML, Automotive, and Wireless Developments Driving Semiconductor Industry Growth in Asia

SSI Bureau

Shielding Your Company: Companies Empowering Employees to Protect Your Business from Cyberattacks

SSI Bureau

Eka Software Records Significant Cloud Momentum in 2021

SSI Bureau

6 comments

Fowfsr March 9, 2024 at 11:32 pm

purchase atorvastatin online atorvastatin 80mg brand atorvastatin cheap

Reply
Bczaff March 18, 2024 at 3:44 pm

ciprofloxacin order online – buy amoxicillin 500mg generic
erythromycin cost

Reply
Risbwl March 20, 2024 at 7:11 pm

ivermectin 12mg pills – buy generic sumycin for sale sumycin 250mg tablet

Reply
Cagcmo March 23, 2024 at 1:50 pm

furosemide ca – order coumadin online generic capoten

Reply
Nubctf March 26, 2024 at 2:49 pm

purchase glucophage without prescription – purchase lincomycin generic buy lincomycin tablets

Reply
Fjiyai March 26, 2024 at 7:51 pm

order retrovir sale – buy glucophage online cheap cheap zyloprim

Reply

Leave a Comment

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More