PT-2015-1069 · Microsoft · Active Directory Federation Services+1

Published 2015-04-14 · Updated 2019-05-08 · CVE-2015-1638

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2

Description The issue is related to the improper handling of logoff actions in Microsoft Active Directory Federation Services (AD FS), allowing remote attackers to bypass intended access restrictions. This can be exploited by leveraging an unattended workstation, potentially leading to information disclosure. An attacker can gain access to a user's information by reopening an application that the user had previously logged out of, without requiring the user's username or password. This vulnerability can be used to obtain data that the user's AD FS account has access to.

Recommendations For Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2, consider implementing additional access controls or monitoring to detect and prevent unauthorized access to user information. As a temporary workaround, restrict access to sensitive applications and data until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09929

CVE-2015-1638

Affected Products

Active Directory Federation Services

Windows Server

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1638 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1638 · Security Note
• https://bdu.fstec.ru/vul/2015-09929 · Security Note
• http://securitytracker.com/id/1032115 · Note
• http://technet.microsoft.com/security/bulletin/ms15-040 · Note