Microsoft NETLOGON Spoofing Vulnerability

A spoofing vulnerability exists in NETLOGON that is caused when the Netlogon service improperly establishes a secure communications channel belonging to a different machine with a spoofed computer name. To successfully exploit this vulnerability, an attacker would first have to be logged on to a domain joined system and be able to observe network traffic. An attacker could then run a specially crafted application that could establish a secure channel connection belonging to different computer. An attacker may be able to use the established secure channel to obtain session-related information for the actual secure channel of the spoofed computer. Workstations and servers are primarily at risk from this vulnerability. The update addresses the vulnerability by modifying the way that Netlogon handles establishing secure channels.