SB2024100890 - Privilege escalation in Microsoft Remote Registry Service

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024100890

SB2024100890 - Privilege escalation in Microsoft Remote Registry Service

Published: October 8, 2024 Updated: October 23, 2024

Security Bulletin ID SB2024100890
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2024-43532)

The vulnerability allows a remote user to escalate privileges in Active Directory domain.

The vulnerability exists due to the way the Remote Registry client handles RPC authentication during certain fallback scenarios when SMB transport is unavailable. A remote user can authenticated against the AD server, intercept the NTLM authentication handshake from the client and forward it to another service, such as the (ADCS), and create a new domain administrator.

Successful exploitation of the vulnerability may allows a domain user to take over the entire AD.


Remediation

Install update from vendor's website.

References