Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Released: Dec 10, 2024
Last updated: Dec 11, 2024
- Assigning CNA
- Microsoft
- CVE.org link
- CVE-2024-49112
- Impact
- Remote Code Execution
- Max Severity
- Critical
- Weakness
- CVSS Source
- Microsoft
- Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Metrics
- CVSS:3.1 9.8 / 8.5Base score metrics: 9.8 / Temporal score metrics: 8.5
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Exploit Code Maturity
Unproven
Remediation Level
Official Fix
Report Confidence
Confirmed
Please see Common Vulnerability Scoring System for more information on the definition of these metrics.
Exploitability
The following table provides an exploitability assessment for this vulnerability at the time of original publication.
- Publicly disclosed
- No
- Exploited
- No
- Exploitability assessment
- Exploitation Less Likely
Mitigations
Is there any action a customer can take to protect against this vulnerability if they are unable to apply the update?
Ensure that domain controllers are configured either to not access the internet or to not allow inbound RPC from untrusted networks. While either mitigation will protect your system from this vulnerability, applying both configurations provides an effective defense-in-depth against this vulnerability.
RPC and LDAP are published externally through SSL. What does this mitigation mean in the context of external network connectivity?
Applying the mitigations will decrease the risk of an attacker successfully convincing or tricking a victim into connecting to a malicious server. If a connection is made, the attacker could send malicious requests to the target over SSL.
FAQ
What actions do customers need to perform to be protected against this vulnerability?
This vulnerability affects both LDAP clients and servers running an affected version of Windows listed in the Security Updates table. Customers must apply the latest security update for their Windows version to be protected against this vulnerability.
How could an attacker exploit this vulnerability?
A remote unauthenticated attacker who successfully exploited this vulnerability would gain the ability to execute arbitrary code within the context of the LDAP service. However successful exploitation is dependent upon what component is targeted.
In the context of exploiting a domain controller for an LDAP server, to be successful an attacker must send specially crafted RPC calls to the target to trigger a lookup of the attacker's domain to be performed in order to be successful.
In the context of exploiting an LDAP client application, to be successful an attacker must convince or trick the victim into performing a domain controller lookup for the attacker’s domain or into connecting to a malicious LDAP server. However, unauthenticated RPC calls would not succeed.
Could an attacker leverage inbound RPC tunnels connected to Windows 11 to successfully exploit this vulnerability?
Yes, an attacker could use an RPC connection to a domain controller to trigger domain controller lookup operations against the attacker's domain.
Acknowledgements
- Yuki Chen
Security Updates
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle.
- 10.0.17763.6659
- 10.0.17763.6659
- 6.3.9600.22318
- 6.3.9600.22318
- 6.2.9200.25222
- 6.2.9200.25222
- 6.1.7601.27467
- 6.1.7601.27467
- 6.1.7601.27467
- 6.1.7601.27467
- 6.0.6003.23016
- 6.0.6003.23016
- 6.0.6003.23016
- 6.0.6003.23016
- 6.0.6003.23016
- 6.0.6003.23016
- 6.0.6003.23016
- 6.0.6003.23016
- 10.0.14393.7606
- 10.0.14393.7606
- 10.0.14393.7606
- 10.0.14393.7606
- 10.0.10240.20857
- 10.0.10240.20857
- 10.0.26100.2605
- 10.0.26100.2528
- 10.0.26100.2605
- 10.0.26100.2528
- 10.0.26100.2605
- 10.0.26100.2528
- 10.0.25398.1308
- 10.0.22631.4602
- 10.0.22631.4602
- 10.0.26100.2605
- 10.0.26100.2528
- 10.0.19045.5247
- 10.0.19045.5247
- 10.0.19045.5247
- 10.0.22621.4602
- 10.0.22621.4602
- 10.0.19044.5247
- 10.0.19044.5247
- 10.0.19044.5247
- 10.0.20348.2966
- 10.0.20348.2908
- 10.0.20348.2966
- 10.0.20348.2908
- 10.0.17763.6659
- 10.0.17763.6659
Disclaimer
Revisions
Added FAQ information. This is an informational change only.
Added FAQ to provide further vulnerability details. This is an informational change only.
Information published.