Windows NTLM relaying attacks

Some client program use NTLM authentication with user's permission without user request. It may leak to NTLM credentials and perform choosen challenge attack and comprometation of server's with client credentials by relaying NTLM request...

Authentication flaw in microsoft SMB protocol

Detailed information: http://seclab.ce.aut.ac.ir/vreport.htm Summary ======= Microsoft uses SMB Protocol for “File and Printer sharing service” in all versions of Windows. Upon accessing a network resource, NTLM Authentication is used to authenticate the client on the server. When a logged-in use...

Remote Vulnerabilties in mod_ntlm

Product Description modntlm is an Apache module originially designed for Apache 1.3, now available for Apache 2.0 that provides the ability for Apache services to authenticate users via the NTLM authentication technology that is largely specific to Microsoft IIS. Home page:...

mod_ntlm.txt

Product Description modntlm is an Apache module originially designed for Apache 1.3, now available for Apache 2.0 that provides the ability for Apache services to authenticate users via the NTLM authentication technology that is largely specific to Microsoft IIS. Home page:...

EUVD-2002-0054

SMTP service in 1 Microsoft Windows 2000 and 2 Internet Mail Connector IMC in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials...

PT-2003-1406 · Ethereal · Ethereal

Name of the Vulnerable Software and Affected Versions: Ethereal versions 0.9.9 and earlier Description: A heap-based buffer overflow issue exists in the NTLMSSP code, which can be exploited by remote attackers to cause a denial of service and potentially execute arbitrary code. Recommendations: F...

Microsoft Windows SMTP Service fails to properly handle responses from the NTLM authentication layer

Overview A flaw in the authentication code of the SMTP service provided with Windows 2000 server and Exchange 5.5 may allow a user access to the SMTP service. This acess could be used to relay mail in violation of the SMTP server's security policy, or consume CPU resources on the SMTP server...

CVE-2002-0419

Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which 2 in certain configurations, the server IP address is provided as the realm for Basic authentication, which...

CVE-2002-0054

SMTP service in 1 Microsoft Windows 2000 and 2 Internet Mail Connector IMC in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials...

IIS SMTP component allows mail relaying via Null Session

BindView Security Advisory -------- IIS SMTP component allows mail relaying via Null Session Issue Date: March 1, 2002 Contact: [email protected] Topic: The SMTP component that comes with IIS can be used by anyone for relaying email. Overview: IIS comes with a small SMTP component. The...

Outlook Express and SPA (Secure Password Authentication)

Topic: Outlook Express and SPA Secure Password Authentication Author: 3APA3A Affected Software: Internet Explorer 5.5, 6.0 Vendor: Microsoft Status: Informational 1. Background: Outlook Express doesn't support CRAM-MD5 or APOP and there is only one way to authenticate user on POP3/IMAP/SMTP serve...

Outlook Express and SPA (Secure Password Authentication)

Topic: Outlook Express and SPA Secure Password Authentication Author: 3APA3A [email protected] Affected Software: Internet Explorer 5.5, 6.0 Vendor: Microsoft Status: Informational 1. Background: Outlook Express doesn't support CRAM-MD5 or APOP and there is only one way to authenticate user...

CVE-2001-0003

The CVE-2001-0003 entry concerns Web Extender Client (WEC) in Microsoft Office 2000, Windows 2000, and Windows Me. The issue is that WEC does not correctly process Internet Explorer security settings for NTLM authentication, which can allow an attacker to obtain NTLM credentials and potentially o...

CVE-2001-0003

Web Extender Client WEC in Microsoft Office 2000, Windows 2000, and Windows Me does not properly process Internet Explorer security settings for NTLM authentication, which allows attackers to obtain NTLM credentials and possibly obtain the password, aka the "Web Client NTLM Authentication"...

CVE-2001-0016

CVE-2001-0016 concerns the NTLMSSP (NTLM Security Support Provider) service. The LPC request handling bug allows a local user to gain administrator-level privileges by exploiting improper function-number checks, enabling local privilege escalation on affected Windows systems. Reported as MS01-008...

Microsoft Windows 2000 Workstation in mixed-mode domain may ignore domain account lockout restriction due to flaw in NTLM authentication

Overview A flaw in certain configurations of Windows 2000 can allow an intruder to make an unlimited number of guesses to attempt to determine a password, despite policies intended to limit the number of guesses. Description Domain administrators can set policies governing certain aspects of...

CVE-2001-0016

NTLM Security Support Provider NTLMSSP service does not properly check the function number in an LPC request, which could allow local users to gain administrator level access...

CVE-2001-0003

Web Extender Client WEC in Microsoft Office 2000, Windows 2000, and Windows Me does not properly process Internet Explorer security settings for NTLM authentication, which allows attackers to obtain NTLM credentials and possibly obtain the password, aka the "Web Client NTLM Authentication"...

Local promotion in NT4's NTLM Security Support Provider

BindView Security Advisory -------- Local promotion vulnerability in NT4's NTLM Security Support Provider Issue Date: February 7, 2001 Contact: [email protected] Topic: Local promotion vulnerability in NT4's NTLM Security Support Provider Overview: Due to a flaw in the NTLM Security Suppo...

CVE-2000-0834

The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// URL that points to the malicious server, aka the "Windows 2000 Telnet Client NTLM Authentication" vulnerability...