CVE-2016-0037

The forms-based authentication implementation in Active Directory Federation Services ADFS 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service daemon outage via crafted data, aka "Microsoft Active Directory Federation Services Denial of Service...

CVE-2016-0037

CVE-2016-0037 affects Microsoft Windows Server 2012 R2 with Active Directory Federation Services (ADFS) 3.0 . The issue arises in the forms-based authentication flow, where crafted input can cause a denial of service resulting in a daemon outage and an unresponsive ADFS service. The vulnerability...

MS16-020: Security Update for Active Directory Federation Services to Address Denial of Service (3134222)

The remote Windows host is missing a security update. It is, therefore, affected by a denial of service vulnerability in Active Directory Federation Services ADFS due to a failure to properly process certain input during forms-based authentication. A remote attacker can exploit this, via crafted...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (2873872)

This host is missing an important security update according to Microsoft Bulletin MS13-066. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows ADFS服务单次登录功能认证欺骗漏洞（MS09-070）

BUGTRAQ ID: 37215 CVE ID: CVE-2009-2508 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的ADFS服务没有充分地验证会话管理，如果攻击者能够访问目标用户近期所使用的用于访问提供单次登录站点的工作站和Web浏览器，就可能允许攻击者扮演为通过认证的用户。 攻击者必须可以访问终端上之前用户所使用的认证令牌才可以利用这个漏洞。在启用了HTTPS服务器的情况下，认证令牌在传输中是受保护的，攻击者必须能够访问受害者的计算机（如自助终端机）才可以利用这个漏洞。在自助终端机上，用户可能登录到ADFS SSO...

Microsoft ADFS服务请求头验证远程代码执行漏洞（MS09-070）

BUGTRAQ ID: 37214 CVE ID: CVE-2009-2509 Microsoft Windows是微软发布的非常流行的操作系统。 由于通过认证的用户在连接到启用了活动目录联合服务（ADFS）的Web服务器时没有正确地验证请求头，导致ADFS实现中存在远程代码执行漏洞。远程攻击者可以通过向服务器提交恶意的HTTP请求导致以Worker Process Identity的权限执行任意代码。 Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2008 Microsoft Windows Server 2003...

Remote code execution

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

Design/Logic Flaw

The single sign-on implementation in Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previou...

CVE-2009-2508

The single sign-on implementation in Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previou...

CVE-2009-2508

CVE-2009-2508 affects Microsoft Windows ADFS SSO: the single sign-on implementation does not properly discard credentials at end of a session, enabling physically proximate attackers to impersonate a previous user by reusing browser-cache data. Affected are Windows Server 2003 SP2 and Windows Ser...

CVE-2009-2509

In CVE-2009-2509, Active Directory Federation Services (ADFS) on Windows Server 2003 SP2 and Windows Server 2008 SP2/Gold exposes remote code execution due to incorrect validation of HTTP request headers by an authenticated user. A crafted HTTP request to an ADFS-enabled IIS web server can execut...

Microsoft Windows ADFS Remote Code Execution Vulnerability (971726)

This host is missing a critical security update according to Microsoft Bulletin MS09-070. OpenVAS Vulnerability Test $Id: secpodms09-070.nasl 5363 2017-02-20 13:07:22Z cfi $ Microsoft Windows ADFS Remote Code Execution Vulnerability 971726 Authors: Antu Sanadi Updated By: Madhuri D on 2011-01-12 ...

Microsoft Windows ADFS Remote Code Execution Vulnerability (971726)

This host is missing a critical security update according to Microsoft Bulletin MS09-070. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Inside MS Patch Tuesday: Pay Attention to MS09-072

Guest editorial by Jason Miller Microsoft has released six new security bulletins for December. They have also released two new security advisories as well as one bulletin that has been re-released. In addition to the Microsoft releases, even though Adobe’s quarterly security update is scheduled...

Microsoft Windows Active Directory Single Sign On Authentication Spoofing Vulnerability

Description Microsoft Windows Active Directory Federation Services ADFS is prone to an authentication-spoofing vulnerability affecting single sign-on SSO websites because it fails to properly implement session management. Successful exploits will allow attackers to authenticate to trusted servers...

Microsoft Active Directory Federation Services Code Execution (MS09-070; CVE-2009-2509)

Active Directory provides central authentication and authorization services for Windows-based systems. Active Directory Federation Services ADFS helps the client to use single sign-on by securely sharing digital identity and entitlement rights across security and enterprise boundaries. A remote...

Windows Rights Management Services Client with Service Pack 2 (KB917275)

Rights Management Services RMS client Service Pack 2 contains software updates for RMS Client v1.0 and RMS Client v1.0 SP1 that provide support for Microsoft new Exchange and Office SharePoint technologies and future implementations of ADFS clients, as well as improvements in security processor...