PT-2015-1069 · Microsoft · Active Directory Federation Services+1

Publicado 2015-04-14 · Atualizado 2019-05-08 · CVE-2015-1638

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2

Description The issue is related to the improper handling of logoff actions in Microsoft Active Directory Federation Services (AD FS), allowing remote attackers to bypass intended access restrictions. This can be exploited by leveraging an unattended workstation, potentially leading to information disclosure. An attacker can gain access to a user's information by reopening an application that the user had previously logged out of, without requiring the user's username or password. This vulnerability can be used to obtain data that the user's AD FS account has access to.

Recommendations For Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2, consider implementing additional access controls or monitoring to detect and prevent unauthorized access to user information. As a temporary workaround, restrict access to sensitive applications and data until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09929

CVE-2015-1638

Produtos afetados

Active Directory Federation Services

Windows Server

Referências · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-040 · Aviso do Fabricante
• http://securitytracker.com/id/1032115 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-040 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1638 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1638 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09929 · Nota de Segurança