PT-2019-2826 · Microsoft · Windows+1
Joe Tammariello
·
Publicado
2019-06-04
·
Atualizado
2020-10-19
·
CVE-2019-9510
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows versions 10 1803 and later
Microsoft Windows Server versions 2019 and later
Description
The issue is related to errors in handling RDP sessions based on NLA, allowing an attacker to bypass two-factor authentication mechanisms by temporarily disconnecting an RDP connection and then automatically reconnecting. This can enable authenticated RDP-connected clients to gain access to user sessions without interacting with the Windows lock screen. If a network anomaly triggers a temporary RDP disconnect, the Automatic Reconnection of the RDP session will restore it to an unlocked state. An attacker with access to a system being used as a Windows RDP client can exploit this by interrupting network connectivity to gain access to a connected remote system, regardless of whether the remote system was locked.
Recommendations
For Microsoft Windows versions 10 1803 and later, consider disabling Automatic Reconnection of RDP sessions as a temporary workaround until a patch is available.
For Microsoft Windows Server versions 2019 and later, restrict access to RDP connections to minimize the risk of exploitation.
Avoid using RDP connections on untrusted networks until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Handling of Exceptional Conditions
Authentication Bypass Using an Alternate Path or Channel
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Windows
Windows Server