Overview

In December 2024, Microsoft disclosed two critical vulnerabilities affecting the Windows Lightweight Directory Access Protocol (LDAP) services: CVE-2024-49112 and CVE-2024-49113. These vulnerabilities pose significant security risks, necessitating immediate attention and remediation.

Background on LDAP

LDAP is a protocol used to access and manage directory information services over a network. In Windows environments, LDAP plays a crucial role in Active Directory, facilitating user authentication, authorization, and directory searches. Its integral function makes it a prime target for attackers seeking to exploit network infrastructures.

Details of the Vulnerabilities

CVE-2024-49112: Remote Code Execution Vulnerability

  • Severity: Critical
  • CVSS Score: 9.8
  • Description: This vulnerability allows unauthenticated remote attackers to execute arbitrary code within the context of the LDAP service by sending specially crafted LDAP requests. The flaw stems from an integer overflow in the LDAP service's processing mechanism.
  • Potential Impact:
    • Unauthorized system access
    • Privilege escalation
    • Compromise of domain controllers
    • Lateral movement within the network

CVE-2024-49113: Denial of Service Vulnerability

  • Severity: Important
  • CVSS Score: 7.5
  • Description: This vulnerability enables remote attackers to cause a denial of service by sending malformed LDAP packets, leading to service crashes or unresponsiveness. The issue arises from an out-of-bounds read in the LDAP service.
  • Potential Impact:
    • Service disruptions
    • System instability
    • Interruption of authentication and directory services

Affected Systems

The vulnerabilities impact various Windows versions, including:

  • Windows Server 2016
  • Windows Server 2019
  • Windows Server 2022
  • Windows 10 (versions 21H2 and 22H2)
  • Windows 11 (versions 21H2 and 22H2)

All domain controllers, LDAP servers, and LDAP client applications running these versions are susceptible and require immediate patching.

Implications and Impact

Exploitation of these vulnerabilities can have severe consequences:

  • CVE-2024-49112: Successful exploitation could grant attackers full control over affected systems, leading to data breaches, deployment of malware, and further network compromise.
  • CVE-2024-49113: While less severe, exploitation could disrupt critical services, affecting business operations and potentially leading to financial losses.

Technical Details

CVE-2024-49112:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Exploit Mechanism: An attacker sends a crafted DCE/RPC request, prompting the target server to perform a domain lookup to a malicious LDAP server controlled by the attacker. This triggers the integer overflow, allowing code execution.
CVE-2024-49113:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Exploit Mechanism: An attacker sends specially crafted LDAP packets that cause the LDAP service to read out-of-bounds memory, leading to a crash or hang.

Mitigation and Patching

Microsoft has released patches addressing these vulnerabilities in the December 2024 Patch Tuesday update. Organizations are strongly advised to:

  1. Apply Security Updates: Install the latest patches on all affected systems immediately.
  2. Restrict Network Access: Limit exposure of LDAP services by configuring firewalls and access controls to restrict inbound connections from untrusted networks.
  3. Monitor Systems: Implement monitoring to detect unusual LDAP activity and potential exploitation attempts.

Conclusion

The disclosure of CVE-2024-49112 and CVE-2024-49113 underscores the importance of timely patching and vigilant network security practices. Organizations must prioritize these updates to safeguard their systems against potential exploits.