Improper authentication in Microsoft Windows and Windows Server - CVE-2017-8563
Published: July 11, 2017 / Updated: July 11, 2017
Vulnerability identifier: #VU7453
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8563
CWE-ID: CWE-287
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists in Microsoft Windows when Kerberos falls back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol. A remote attacker can send specially crafted requests to domain controller and trigger the fall back to less secure authentication protocol.
Successful exploitation of the vulnerability may allow an attacker to perform a MitM attack, intercept network traffic and gain access to users’ credentials.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2017-8563
Install updates from vendor's website.
Note: To make LDAP authentication over SSL/TLS more secure, administrators need to create a LdapEnforceChannelBinding registry setting on a Domain Controller. For more information about setting this registry key, see Microsoft Knowledge Base article 4034879.
Note: To make LDAP authentication over SSL/TLS more secure, administrators need to create a LdapEnforceChannelBinding registry setting on a Domain Controller. For more information about setting this registry key, see Microsoft Knowledge Base article 4034879.