PT-2015-4395 · Microsoft · Internet Authentication Service+3

Published 2015-01-13 · Updated 2019-02-26 · CVE-2015-0015

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server versions 2003 SP2, 2008 SP2 and R2 SP1, and 2012 Gold and R2

Description This issue allows remote attackers to cause a denial of service condition, resulting in a system hang and RADIUS outage, by sending crafted username strings to either the Internet Authentication Service (IAS) or the Network Policy Server (NPS). An unauthenticated attacker could exploit this to prevent RADIUS authentication, causing the target system to stop responding. Note that this does not allow code execution or user rights elevation. Network Policy Servers that allow remote, untrusted user authentication are particularly at risk.

Recommendations For Microsoft Windows Server 2003 SP2, update to a version that includes the fix for this issue. For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a version that includes the fix for this issue. For Microsoft Windows Server 2012 Gold and R2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Internet Authentication Service (IAS) or Network Policy Server (NPS) to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-0015

Affected Products

Internet Authentication Service

Network Policy Server

Windows

Windows Server

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0015 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0015 · Security Note
• http://secunia.com/advisories/62148 · Note
• http://securitytracker.com/id/1031532 · Note
• http://securityfocus.com/bid/71933 · Note
• http://technet.microsoft.com/security/bulletin/ms15-007 · Note