SB2022092055 - Spoofing attack in Microsoft Endpoint Configuration Manager
Published: September 20, 2022
Security Bulletin ID
SB2022092055
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2022-37972)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the way Microsoft Endpoint Configuration Manager handles Kerberos authentication failures. The application attempts to use NTLM to authenticate even if disabled by the "Allow connection fallback to NTLM" option. A remote attacker can perform spoofing attack and extract victims credentials via NTLM connection.
Remediation
Install update from vendor's website.