Skip to content
OpenAdvisories
High MSRC-CVE-2021-36949 1 CVE

Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability

Published Aug 10, 2021 · Updated Aug 10, 2021 · Revision 2

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What should I do to be protected against this vulnerability?
In addition to applying the updates in this CVE, you will need to disable NTLM as per the guidance as follows:
For Azure Active Directory Connect, see Prerequisites for Azure AD Connect
For Azure Active Directory Connect Provisioning Agent, see Prerequisites for Azure AD Connect cloud sync
The attacker must be able to establish Man-in-the-middle between your Azure AD Connect server and a domain controller. The attacker also needs to possess domain user credentials to be able to exploit this vulnerability.

Security updates
1.6.11.3 — https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history
1.1.582.0 — https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/provisioning-agent-release-version-history#115820

Vulnerabilities 1

Revision history

  1. #1

    Information published.

  2. #2

    The following revisions have been made: 1) In the Security Updates table, added Azure Active Directory Connect Provisioning Agent as it is also affected by this vulnerability 2) Updated FAQs.

References