Overview
Microsoft PKINIT smart card authentication is vulnerable to an information disclosure flaw that may allow an attacker to spoof a trusted server.
Description
From the Microsoft PKINIT description: PKINIT is an Internet Engineering Task Force (IETF) Internet Draft for "Public Key Cryptography for Initial Authentication in Kerberos." Windows 2000 and later uses draft 9 of the IETF "Public Key Cryptography for Initial Authentication in Kerberos" Internet Draft. Windows uses this protocol when you use a smart card for interactive logon. IETF Internet Drafts are available at the following IETF Web site. When PKINIT smart card authentication is used, an attacker may be able to inject themselves into an authentication session between a user and a domain controller and exploit this flaw. After exploiting the flaw, the attacker may spoof the application server to a target client. This flaw is due to a weakness in the older PKINIT protocol design specification that is implemented. Both the attacker and the target user must have their accounts enabled for smart card authentication. The attacker must already have valid logon credentials in order to successfully exploit the flaw. |
Impact
A remote, authenticated attacker that is able to intercept an authentication session between a user and domain controller may be able to gain confidential information and spoof a trusted application server to a targeted user. |
Solution
Apply An Update |
Vendor Information
477341
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Microsoft for reporting this vulnerability, who in turn thank Andre Scedrov and his team; Iliano Cervesato, Aaron Jaggard , Joe-Kai Tsay , and Chris Walstad.
This document was written by Ken MacInnis.
Other Information
| CVE IDs: | CVE-2005-1982 |
| Severity Metric: | 4.56 |
| Date Public: | 2005-08-09 |
| Date First Published: | 2005-11-09 |
| Date Last Updated: | 2005-11-09 15:43 UTC |
| Document Revision: | 16 |