QID 91798

Date Published: 2021-08-02

QID 91798: Microsoft Guidance For Mitigating NTLM Relay Attacks (ADV210003)

Microsoft has announced the availability of a new feature, Extended Protection for Authentication, on the Windows platform. This feature enhances the protection and handling of credentials when authenticating network connections using Integrated Windows Authentication (IWA).

To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators, must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication (EPA) or signing features such as SMB signing

QID Detection Logic:
Based on ADV210003 and KB5005413 , this authenticated QID checks if the values of the following keys is set to
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters is 0 or 7.
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 is 1 or 2.
and also checks for workaround applied in web.config file.

Successful exploitation of this attack allows attackers to take over windows domains.

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as Medium - 4.3 severity.

Solution

Customers are advised to refer to ADV210003 and KB5005413 for more information.

Vendor References

ADV210003 - msrc.microsoft.com/update-guide/vulnerability/ADV210003

CVEs related to QID 91798

Software Advisories

Advisory ID	Software	Component	Link
ADV210003			msrc.microsoft.com/update-guide/vulnerability/ADV210003
KB5005413			support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].