CERT-In Vulnerability Note
CIVN-2009-0136
Microsoft Active Directory LDAP Denial of Service Vulnerability
Original Issue Date:November 11, 2009
Severity Rating: MEDIUM
Systems Affected
- Microsoft Windows 2000 Server Service Pack 4
- Windows XP Service Pack 2
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Server 2008 for 32-bit Systems
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems
- Windows Server 2008 for x64-based Systems Service Pack 2
Overview
A Vulnerability has been reported in Microsoft Windows Active Directory component which could allow an unauthenticated remote attacker to cause a denial of service DoS condition.
Description
Active Directory is to provide central authentication and authorization services for Windows-based computers. Active Directory Lightweight Directory Services AD LDS is an independent mode of Active Directory that provides dedicated directory services for applications. AD LDS is available in Windows Server 2008 and later, and replaces Active Directory Application Mode ADAM , which was available in Windows XP and Windows Server 2003. Lightweight Directory Access Protocol LDAP is an open network protocol standard designed to provide access to distributed directories.
A Denial of Service vulnerability is reported in implementation of Active Directory on Microsoft Windows 2000 Server, Windows Server 2003, Windows Server 2008 and Active Directory Application Mode ADAM installed on Windows XP and Windows Server 2003, and Active Directory Lightweight Directory Service AD LDS on Windows Server 2008. This vulnerability is caused due to errors in processing malformed LDAP or LDAPS requests. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted malicious requests to an affected system. Local Security Authority Subsystem Service LSASS could exhaust available space in the memory stack while processing malicious requests. Successful exploitation of this vulnerability could allow remote attacker to turn Active Directory to non-responding condition, resulting in a DoS condition.
Workaround
- Block TCP ports 389, 636, 3268 and 3269 at the firewall
Solution
pply appropriate patches as mentioned in Microsoft Security Bulletin
MS09-066
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms09-066.mspx
References
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=19308
SecurityTracker
http://securitytracker.com/alerts/2009/Nov/1023156.html
SecurityFocus
http://www.securityfocus.com/bid/36918
CVE Name
CVE-2009-1928
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|