Critical Vulnerabilities in NTLM Allow Remote Code Execution and Cloud Resources Compromise

guest · Jun 11, 2019

Critical Vulnerabilities in NTLM Allow Remote Code Execution and Cloud Resources Compromise
June 11, 2019
https://blog.preempt.com/security-advisory-critical-vulnerabilities-in-ntlm

On June 2019 Patch Tuesday, Microsoft released patches for CVE-2019-1040 and CVE-2019-1019, two vulnerabilities discovered by Preempt researchers. The critical vulnerabilities consist of three logical flaws in NTLM (Microsoft’s proprietary authentication protocol). Preempt researchers were able to bypass all major NTLM protection mechanisms.

These vulnerabilities allow attackers to remotely execute malicious code on any Windows machine or authenticate to any HTTP server that supports Windows Integrated Authentication (WIA) such as Exchange or ADFS. All Windows versions are vulnerable.
Click to expand...

Over the years, Microsoft has developed several mitigations for thwarting such NTLM relay attacks, Preempt research were able to bypass all the significant defense mechanisms:

Message Integrity Code (MIC) - The ‘MIC’ field ensures that NTLM messages are not tampered by attackers. However, our bypass allows attackers to remove the ‘MIC’ protection and modify various fields in the NTLM authentication flow, such as signing negotiation. Full details are available in this blog.

SMB Session Signing - Prevents attackers from relaying NTLM authentication messages to establish SMB and DCE/RPC sessions. The bypass we discovered enables attackers to relay NTLM authentication requests to any server in the domain, [...] Full details are available in this blog.

Enhanced Protection for Authentication (EPA) - Prevents attackers from relaying NTLM messages to TLS sessions. Our bypass allows attackers to modify NTLM messages to generate legitimate channel binding information. [...] Full details are available in this blog.

Click to expand...

Log in or Sign up

Critical Vulnerabilities in NTLM Allow Remote Code Execution and Cloud Resources Compromise

guest Guest

Log in or Sign up

Critical Vulnerabilities in NTLM Allow Remote Code Execution and Cloud Resources Compromise

guest Guest

Useful Searches