Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

Bugtraq ID:	75023
Class:	Input Validation Error
CVE:	CVE-2015-1757
Remote:	Yes
Local:	No
Published:	Jun 09 2015 12:00AM
Updated:	Jul 15 2015 12:29AM
Credit:	John Hollenberger and Tate Hansen from FishNet Security.
Vulnerable:	Avaya Meeting Exchange - Webportal 0
Not Vulnerable:

Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

Microsoft Active Directory Federation Services is prone to a remote privilege-escalation vulnerability because it fails to sanitize user-supplied input.

An attacker can exploit this issue to gain elevated privileges and perform unauthorized actions in the context of the currently logged-in user; this may aid in launching further attacks.

Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

References:

• Microsoft Homepage (Microsoft)