Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-0128: Windows SAM/LSAD downgrade lets attackers impersonate users

CVE-2016-0128 · published 10 years ago

Summary

Windows 7, 8.1, 10, Server 2008 and related versions do not correctly set up a secure communication channel for certain account-management protocols. This flaw lets a network attacker intercept and alter the data, potentially posing as a legitimate user. Install the latest security updates from Microsoft to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10	1511 `cpe:2.3:o:microsoft:windows_10:-:::::::*`
microsoft	windows_7	All versions `cpe:2.3:o:microsoft:windows_7::sp1::::::*`
microsoft	windows_8.1	All versions `cpe:2.3:o:microsoft:windows_8.1::::::::`
microsoft	windows_rt_8.1	All versions `cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008::sp2::::::*`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_vista	All versions `cpe:2.3:o:microsoft:windows_vista::sp2::::::*`

Original advisory text

The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."

References

http://badlock.org/ Third Party Advisory
http://www.securitytracker.com/id/1035534 Third Party Advisory VDB Entry
https://bto.bluecoat.com/security-advisory/sa122 Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-04... Patch Vendor Advisory
https://www.kb.cert.org/vuls/id/813296 Third Party Advisory US Government Resource
https://www.samba.org/samba/security/CVE-2016-2118.html Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.8 Medium

Exploitation

21% chance of attack within 30 days

Type

CWE-2547PK - Security Features

Timeline

Published12 Apr 2016

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2016-0128 · NVD

Track software like this

Free during beta