PT-2017-10432 · Microsoft · Adfs+4

Publicado 2017-04-11 · Atualizado 2019-10-03 · CVE-2017-0159

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Windows 10 version 1607 Windows Server 2012 R2 Windows 2016

Description A security feature bypass issue exists when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests. This allows attackers to affect the system.

Recommendations For Windows 10 version 1607, update the ADFS configuration to correctly differentiate between Extranet and Intranet requests. For Windows Server 2012 R2, apply the necessary security patches to address the ADFS security feature bypass. For Windows 2016, reconfigure ADFS to properly handle requests from Extranet clients.

Correção

Identificadores relacionados

CVE-2017-0159

Produtos afetados

Adfs

Windows

Windows 10

Windows 2016

Windows Server 2012 R2

Referências · 7

• http://securityfocus.com/bid/97449 · Nota
• http://securitytracker.com/id/1038243 · Nota
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0159 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0159 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0159 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0159 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0159 · Nota de Segurança