PT-2017-10432 · Microsoft · Adfs+4

Published 2017-04-11 · Updated 2019-10-03 · CVE-2017-0159

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Windows 10 version 1607 Windows Server 2012 R2 Windows 2016

Description A security feature bypass issue exists when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests. This allows attackers to affect the system.

Recommendations For Windows 10 version 1607, update the ADFS configuration to correctly differentiate between Extranet and Intranet requests. For Windows Server 2012 R2, apply the necessary security patches to address the ADFS security feature bypass. For Windows 2016, reconfigure ADFS to properly handle requests from Extranet clients.

Fix

Related Identifiers

CVE-2017-0159

Affected Products

Adfs

Windows

Windows 10

Windows 2016

Windows Server 2012 R2

References · 7

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0159 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0159 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0159 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0159 · Security Note
• http://securityfocus.com/bid/97449 · Note
• http://securitytracker.com/id/1038243 · Note