Trusted Design

Microsoft Windows & Samba spoofing authenticated users "Badlock"

概要

An elevation of privilege vulnerability exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols when they accept authentication levels that do not protect the RPC channel adequately. The vulnerability is caused by the way the SAM and LSAD remote protocols establish the Remote Procedure Call (RPC) channel. An attacker who successfully exploited this vulnerability could gain access to the SAM database. To exploit the vulnerability, an attacker could launch a man-in-the-middle (MiTM) attack, force a downgrade of the authentication level of the RPC channel, and then impersonate an authenticated user.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Cisco default credentials - again! (score: 0.46)
• Unknown Brute force windows logon attack 173.194.132.77 (score: 0.44)
• Synology NAS servers contain insecure default credentials (score: 0.42)
• MajikPOS Combines PoS Malware and RATs to Pull Off its Malicious Tricks (score: 0.38)
• Unsupported TeamViewer Versions Exploited For Backdoors, Keylogging (score: 0.37)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る