Man-in-the-Middle (MitM) attack in Microsoft Windows and Windows Server - CVE-2019-1040

Vulnerability details

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to a tampering issue. A remote attacker can perform a man-in-the-middle attack, bypass the NTLM MIC (Message Integrity Check) protection and downgrade NTLM security features.

Affected software

How to mitigate CVE-2019-1040

Links to Public Exploits and PoC-codes

• Exploit #5303 - UltraRealy_with_CVE-2019-1040 (Updated version for the tool UltraRealy with support of the CVE-2019-1040 exploit) (April 18, 2021)
• Exploit #4988 - dcpwn (an impacket-dependent script exploiting CVE-2019-1040) (January 3, 2021)

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1040

Related Security Bulletins

• NTLM Tampering in Microsoft Windows