Microsoft Active Directory Federation Services Information Disclosure Vulnerabilities

Summary

Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka ‘Active Directory Federation Services Information Disclosure Vulnerability.’

Credit:

The information has been provided by Microsoft.


Details

Vulnerable Systems:
 * Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0

Immune Systems:
 * Microsoft Active Directory Federation Services (AD FS) after 3.0

Microsoft Active Directory Federation Services (ADFS) could allow a local attacker to obtain sensitive information, caused by a failure to properly log off a user. By reopening an application that the victim believes to have logged out of, an attacker could exploit this vulnerability to gain access to the victim’s information and obtain other sensitive information that the ADFS user has access to.

CVE Information:
CVE-2014-6331

Disclosure Timeline:
Original release date: 11/11/2014
Last revised: 11/12/2014

Categories: Windows