Check Point Advisories

Microsoft Windows Active Directory LDAPS Authentication Bypass (MS11-086; CVE-2011-2014)

Vulnerability
Protection

Check Point Reference:	CPAI-2012-041
Date Published:	31 Jan 2012
Severity:	High
Last Updated:	Monday 25 November, 2024
Source:	CVE-2011-2014
Protection Provided by:	Security Gateway R75
Who is Vulnerable?	Microsoft Windows 7 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008
Vulnerability Description	An elevation of privilege vulnerability has been reported in Microsoft Windows Active Directory.
Vulnerability Details	The vulnerability is caused when Active Directory fails to validate the revocation status of an SSL certificate against the CRL associated with the domain account. A remote attacker may exploit this issue by using a previously revoked certificate to authenticate to the Active Directory domain. Successful exploitation could allow the attacker to gain access to network resources or run code under the privileges of a specific authorized user with which the certificate is associated.

Protection Overview

This protection will detect and block the transferring of malformed LDAP packets.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Microsoft Windows Active Directory LDAPS Authentication Bypass (MS11-086).
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: LDAP Protection Violation
Attack Information: Microsoft Windows Active Directory LDAPS authentication bypass (MS11-086)