KLA10752 Denial of service vulnerability in Microsoft Acrtive Directory Federation Services

Lack of input data checks was found in Microsoft Active Directory Federation Services. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed input to form-based authentication.

Original advisories

CVE-2016-0037

Related products

Microsoft-Active-Directory

CVE list

CVE-2016-0037 warning

KB list

3134222

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Active Directory Federation Services 3.0