CVE-2015-0005

Related Files

Windows Pass-Through Authentication Methods Improper Validation

Posted Mar 11, 2015

Authored by Core Security Technologies | Site coresecurity.com

Core Security Technologies Advisory - The Microsoft Netlogon Remote Protocol is a remote procedure call (RPC) interface that is used, among other things, for user and machine authentication on domain-based networks. In a scenario where a client machine connects to a domain-joined server, a pass-through authentication must be performed in order for the server to verify the client's Credentials with the domain controller. This logon request must be delivered to the domain controller over a secure channel. This secure channel is achieved by encrypting the server to DC communication using a shared secret, commonly known as a server's machine account password. On successful authentication, the domain controller returns the UserSessionKey back to the server. This key is used for cryptographic operations on a session. Examples of the use of this key are generating the keys needed to signing SMB packets, and the keys needed for encryption/decryption of SMB sessions. Improper validation between the account used to secure the communication channel and the logon request data being sent to the domain controller allows third parties to obtain the UserSessionKey for communications that were not meant for them.

tags | exploit, remote, protocol

systems | windows

advisories | CVE-2015-0005

SHA-256 | 2167c7e20b2242c7ce65869777a2ee4ff54c41d53ab3d3bacd78665f8b3aa975

Download | Favorite | View