CVE-2021-33757
published 2021-07-14CVE-2021-33757: Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.0 < 10.0.10240.19003 | 10.0.10240.19003 |
| microsoft | windows_10_version_1607 | >= 10.0.0 < 10.0.14393.4530 | 10.0.14393.4530 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2061 | 10.0.17763.2061 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.1679 | 10.0.18363.1679 |
| microsoft | windows_10_version_2004 | >= 10.0.0 < 10.0.19041.1110 | 10.0.19041.1110 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1110 | 10.0.19042.1110 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1110 | 10.0.19043.1110 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.25661 | 6.1.7601.25661 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.25661 | 6.1.7601.25661 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20069 | 6.3.9600.20069 |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.0.0 < 6.1.7601.25661 | 6.1.7601.25661 |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.0 < 6.1.7601.25661 | 6.1.7601.25661 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.0 < 6.0.6003.21167 | 6.0.6003.21167 |
| microsoft | windows_server_2012 | >= 6.2.0 < 6.2.9200.23409 | 6.2.9200.23409 |
| microsoft | windows_server_2012_r2 | >= 6.3.0 < 6.3.9600.20069 | 6.3.9600.20069 |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | >= 10.0.0 < 10.0.14393.4530 | 10.0.14393.4530 |
| microsoft | windows_server_2019 | >= 10.0.0 < 10.0.17763.2061 | 10.0.17763.2061 |
GHSA
GHSA-x2cp-w42w-phvc: Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-33757 [CRITICAL] GHSA-x2cp-w42w-phvc: Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
Microsoft
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
vendor_msrc·2021-07-13·CVSS 5.3
CVE-2021-33757 [MEDIUM] Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
FAQ: How do the security updates released on July 13, 2021 provide protections for CVE-2021-33757?
After the security updates released on July 13, 2021 or later are installed, Advanced Encryption Standard (AES) encryption will be the preferred method when using the MS-SAMR protocol to change or set account passwords on Windows clients if AES encryption is supported by the SAM server. Please see [KB5004605: Update adds AES encryption protections for CVE-2021-33757[(https://support.microsoft.com/help/5004605) for the following information:
Changes made by this update
How does this new behavior work?
Event logging
Registry settings
FAQ
Windows Security Account Manager: Windows Security Account Manager
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-07-14
Published