Microsoft Issues Urgent Patch Addressing Critical NTLM Vulnerabilities
In a significant update released during this month’s Patch Tuesday, Microsoft has addressed critical vulnerabilities impacting the NT LAN Manager (NTLM) security protocol, which affects all versions of Windows operating systems in enterprises since 2007. This security breach raises alarms among system administrators, as the vulnerabilities could allow attackers to escalate privileges and gain profound control over entire domains.
Researchers from Preempt, a company specializing in behavioral firewalls, uncovered two zero-day vulnerabilities in the NTLM protocols. These flaws enable cybercriminals to create unauthorized domain administrator accounts, effectively granting them control over the target network. The NTLM protocol, while obsolete and replaced by the more secure Kerberos system since Windows 2000, remains widely supported and used, increasing its vulnerability surface.
The first identified vulnerability relates to the Lightweight Directory Access Protocol (LDAP) failing to adequately safeguard against NTLM relay attacks. Although LDAP includes features for signing, it primarily protects against man-in-the-middle threats and does not prevent credential forwarding, exposing systems to greater risk. An attacker with SYSTEM privileges could exploit this flaw to execute LDAP operations on behalf of NTLM users, leading to extensive domain manipulation.
Yaron Zinar, a researcher at Preempt, highlighted the severity of the issue in a recent blog post, noting that all Windows protocols leverage the Windows Authentication API (SSPI), which allows for the downgrading of authentication sessions to NTLM. This underscores the potential for attacks across various connection types—such as SMB, WMI, and SQL—to culminate in unauthorized domain admin access.
To further illustrate the impact, Preempt has published a video demonstrating how credential relay attacks can be executed leveraging these vulnerabilities. The second vulnerability is specific to the Remote Desktop Protocol (RDP) Restricted-Admin mode, which allows users to connect to remote machines without entering their passwords. This functionality can also be exploited, as NTLM authentication can be compromised, enabling attackers to initiate credential relaying against systems using RDP Restricted-Admin.
The researchers responsibly disclosed these vulnerabilities to Microsoft back in April. Microsoft acknowledged the NTLM LDAP vulnerability in May, categorizing it with CVE-2017-8563. However, the company dismissed the RDP issue as a “known problem,” advising users to appropriately configure network defenses against NTLM relay attacks.
Microsoft’s advisory indicated that in a potential remote attack scenario, an attacker could leverage a specifically crafted application to send malicious traffic to a domain controller. By exploiting this flaw, an attacker could elevate their access, posing severe risks to corporate networks. The update aims to bolster authentication protocols against these types of attacks, focusing on the implementation of channel binding information.
Given the critical nature of these vulnerabilities, system administrators are urged to promptly patch any servers that have NTLM enabled. There are preventive measures available: disabling NTLM entirely or requiring digital signing of incoming LDAP and SMB packets would provide necessary protection against credential relay attacks.
Additionally, Microsoft has addressed a total of 55 security vulnerabilities in its products this month, including 19 categorized as critical, affecting platforms ranging from Edge and Internet Explorer to Exchange Server. It is imperative for users to apply these updates to safeguard against active exploitation attempts currently targeting these vulnerabilities.
In conclusion, as these NTLM vulnerabilities highlight the frailty of legacy authentication systems, business owners must remain vigilant and prepared, ensuring their networks are secured against evolving cyber threats. Adhering to best practices in credential management and staying up-to-date with software patches will prove essential in defending against potential security breaches.