Microsoft Addresses NTLM Bugs That Facilitate Credential Relay Attacks

NTLM has a long history of serious vulnerabilities and of causing anxiety for Windows and UNIX server admins. Their collective angst is unlikely to lessen today with the disclosure of a pair of new vulnerabilities in the protocol suite. Microsoft today patched one of the issues among its Patch...

Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully forward an authentication request to a Windows LDAP server, such as a system running Active Directory Domain Services AD DS or Active Directory Lightweight Directory...

FAQ: Password change over LDAP on Read Only Domain Controller Servers

Question : Can customer change password over LDAP when using Read only Domain controller RODC? Answer : Password change is not possible on RODC servers. Note: We support referrals only for group extraction, it might not be applicable for password resets. For information on password change in a...

Microsoft Azure Active Directory Connect Remote Elevation of Privilege Vulnerability

Microsoft Azure Active Directory Connect is a service from Microsoft that provides identity and access management in the cloud. A privilege-lifting vulnerability exists in Microsoft Azure Active Directory Connect versions prior to 1.1.553.0. An attacker could exploit the vulnerability to reset...

CVE-2017-8613

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."...

Microsoft Issues 'Important' Security Fix for Azure AD Connect

Microsoft is warning customers of a bug in its Azure Active Directory Connect product that could allow an adversary to escalate privileges and reset passwords and gain unauthorized access to user accounts. The advisory 4033453 was issued Tuesday via Microsoft’s TechNet website for the vulnerabili...

Users show as Anonymous in XenMobile Server

Users are listed as 'Anonymous' inXenMobile Server after moving their Active Directory Security Group to a new OU...

PermissionHelper is sending incorrect data

h3 summary Permissionhelper didn't send right results for user who should be able to change permissions h3.Environment Confluence 6.1.3 h3. Steps to reproduce 1. Create a group in Active Directory named "app-confluence-space-keyuser", and add some users i.e "test" 2. Create a group in Active...

QakBot Returns, Locking Out Active Directory Accounts

QakBot, a worm-like strain of information-stealing malware that’s been around since 2009, has resurfaced again. The malware has been a thorn in the side of administrators as of late. After a recent stretch of inactivity, researchers now link a rash of recent Microsoft Active Directory lockouts to...

XenMobile Error : Incorrect credentials while enrollment

This article describes few reasons for the error "Incorrect credentials" and how to troubleshoot them a Below error indicates that the user might be typing incorrect credentials or typing sAMAccountName instead of UserPrincipalName vice versa. ,,ERROR 2,"request with id 5 failed with httpResponse...

ManageEngine ServiceDesk Plus Authentication Bypass Vulnerability

ManageEngine ServiceDesk Plus is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descriptio...

ManageEngine ServiceDesk Plus 9.0 Authentication Bypass

Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version: Service Pack 9241 a Build 9.2 Vulnerability Impact: High...

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass Vulnerability

Exploit for java platform in category web applications Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version:...

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass

Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version: Service Pack 9241 – Build 9.2 Vulnerability Impact: High...

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version...

Quest Privilege Manager - pmmasterd Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Quest Privilege Manager pmmasterd Buffer Overflow', 'Description' = %q This modules exploits a buffer overflow in the Quest Privilege Manager, a...

Quest Privilege Manager pmmasterd Buffer Overflow Exploit

This Metasploit modules exploits a buffer overflow in the Quest Privilege Manager, a software used to integrate Active Directory with Linux and Unix systems. The vulnerability exists in the pmmasterd daemon, and can only triggered when the host has been configured as a policy server Privilege...

Quest Privilege Manager pmmasterd Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Quest Privilege Manager pmmasterd Buffer Overflow', 'Description' = %q This modules exploits a buffer overflow in the Quest Privilege Manager, a...

AD Account Lockouts Due to Citrix PIN Password Caching

After a password change at ActiveDirectory, users are seeing account lockouts. XenMobile was causing these lockouts as the password cached with Citrix PIN was not updated...

Discovery of assets in Active Directory

Many security teams work in a world that they can't fully see, let alone control. It can be difficult to know how to make meaningful progress in your vulnerability management program when simply maintaining visibility can be a struggle. One way to get some leverage is to make wise use of asset...