PT-2016-1237 · Microsoft · Active Directory Federation Services (Adfs) 3.0+1

Publicado 2016-02-10 · Atualizado 2019-05-08 · CVE-2016-0037

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2

Description The issue is related to the forms-based authentication implementation in Active Directory Federation Services (ADFS), which allows remote attackers to cause a denial of service via crafted data. This is due to insufficient input validation in the authentication mechanism.

Recommendations For Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2, consider implementing additional input validation measures to prevent the denial of service. As a temporary workaround, restrict access to the forms-based authentication endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00498

CVE-2016-0037

Produtos afetados

Active Directory Federation Services (Adfs) 3.0

Windows Server 2012 R2

Referências · 7

• http://securitytracker.com/id/1034984 · Nota
• http://securityfocus.com/bid/82507 · Nota
• https://osv.dev/vulnerability/CVE-2016-0037 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0037 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-00498 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-020 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-020 · Nota