<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<div>
<div>
<p class="MsoNormal"><span style="color:black">DATE: September 25, 2020<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">Summary:<o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">The CVE-2020-1472 (Netlogon/Zerologon) vulnerability has a high-risk rating and should be remediated via patching the servers promptly, or units should seek a Security Policy Exception with the Information Security Office. <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">Details:<span class="apple-converted-space"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">The Information Security Office discussed the Zerologon Vulnerability (CVE-2020-1472) in today’s Friday 15, but due to the severity of the vulnerability and the fact that there are Domain Controllers that the CITL manage the ISO is
sending out this warning as well.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">The Zerologon vulnerability allows an attacker to compromise Windows Active Directory domain controllers and grant themselves administrative privileges using Netlogon functionality. This creates a threat for any unpatched domain controller.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">An unauthenticated attacker only requires network access to exploit a vulnerable domain controller (DC). This is a critical vulnerability that received a CVSS of 10.0 (highest score) from Microsoft.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">With this information, ISO has concluded the following:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">Threat: High – Multiple versions of the exploit code are available to attackers, and vulnerable domain controllers are actively being exploited.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">Vulnerability: High – Due to the CVSS of 10.0.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">Impact: High – A successful attack would grant the attacker administrative privileges on a DC.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">When the threat, vulnerability and impact are rated High, the Risk Rating is High by using ISO’s risk calculus. There are no mitigating controls or workarounds. The only remediation is to patch all DCs. Therefore, the DCs that are
vulnerable to this attack should be remediated promptly.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">If you’d like more information regarding this vulnerability, please reach out to the Information Security Office at<span class="apple-converted-space"> </span><a href="mailto:infosecoffice@ucr.edu"><span style="color:#03386D">infosecoffice@ucr.edu</span></a>.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline;font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">If it is not possible to patch these systems promptly, a Security Policy Exception should be obtained. Although this process is being updated to better track it, currently the CISO would need to guide individuals through the process. The
Unit head (Dean or VC) would need to sign off on the exception, and there is a possibility that the CRE would also need to sign off on the exception. <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">For more information, see:<span class="apple-converted-space"> </span><a href="https://www.csoonline.com/article/3576193/what-is-zerologon-why-you-should-patch-this-critical-windows-server-flaw-now.html" target="_blank"><span style="color:#03386D">https://www.csoonline.com/article/3576193/what-is-zerologon-why-you-should-patch-this-critical-windows-server-flaw-now.html</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">Here is a video that explains technical details: <a href="https://nakedsecurity.sophos.com/2020/09/21/naked-security-live-the-zerologon-hole-are-you-at-risk/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+nakedsecurity+%28Naked+Security+-+Sophos%29" target="_blank"><span style="color:#03386D">https://nakedsecurity.sophos.com/2020/09/21/naked-security-live-the-zerologon-hole-are-you-at-risk/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+nakedsecurity+%28Naked+Security+-+Sophos%29</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black">For more technical information, see<span class="apple-converted-space"> </span><a href="https://www.secura.com/blog/zero-logon"><span style="color:#03386D">https://www.secura.com/blog/zero-logon</span></a>.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(255, 255, 255);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<b><span style="font-size:12.0pt;color:#002540">Dewight Fredrick Kramer</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:#2A2A2A">Chief Information Security Officer </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:#2A2A2A">Information Technology Solutions</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:#2A2A2A">University of California, Riverside </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<b><span style="font-size:9.0pt;font-family:Wingdings;color:#2A2A2A">(</span></b><b><span style="font-size:8.0pt;font-family:"Arial",sans-serif;color:#2A2A2A"> </span></b><span style="color:#2A2A2A">(951) 827-3070| </span><b><span style="font-size:9.0pt;font-family:Wingdings;color:#2A2A2A">*</span></b><span style="color:#2A2A2A"> </span><span style="color:#0A1729"><a href="mailto:dewight.kramer@ucr.edu"><span style="color:#022B53">dewight.kramer@ucr.edu</span></a></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"><img border="0" width="157" height="48" style="width:1.6354in;height:.5in" id="Picture_x0020_2" src="cid:image001.png@01D6935D.EE07AB90" alt="signature_2034439392"><o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>