CISA Advises Federal Agencies to Patch Windows LSA Flaw Affecting Domain Controllers
Back in May, the Cybersecurity & Infrastructure Security Agency (CISA) temporarily removed a Windows flaw from its Known Exploited Vulnerability (KEV) Catalog due to Active Directory (AD) certificate authentication issues. CISA has now re-added the security vulnerability to KEV, and it’s encouraging IT admins to patch it by deploying the June Patch Tuesday updates by 22 July.
As a reminder, Microsoft released the May 2022 updates to patch a Windows Local Security Authority (LSA) spoofing flaw (CVE-2022-26925). The high severity vulnerability allows attackers to force the domain controller (DC) to authenticate them via Windows NT LAN Manager (NTLM). NTLM is a legacy security protocol that is used for authentication between clients and server machines.
As it turns out, these security patches also caused authentication problems on Windows Server domain controllers. “These changes break certificate authentication for many federal agencies, due to the way Personal Identity Verification (PIV)/Common Access Card (CAC) certificates are created and used. Active Directory now looks for the account’s security identifier (SID) in the certificate or for a strong mapping between the certificate and account,” CISA explained.
Now, CISA has provided a new step-by-step guide with mitigation steps to help organizations prevent authentication issues on domain controllers. The guidance recommends IT admins to configure two registry keys that let them control if the domain controller is in “Compatibility Mode” or “Full Enforcement Mode.”
Microsoft to move Windows Server devices to Full Enforcement mode in 2023
Microsoft explained in its support document that the May 2022 update switches Windows Server devices to Compatibility Mode to mitigate NTLM relay attacks. The company plans to remove Compatibility Mode and automatically update all devices to Full Enforcement Mode in May 2023. However, CISA warned that this change could potentially break the authentication mechanism if IT admins have not “created a strong mapping or added SIDs to certificates.”
Currently, CISA doesn’t recommend federal agencies to migrate to strong certificate-user mapping to avoid potential conflicts in certain use cases. The security agency is collaborating with Microsoft to address this issue, and we hope that a fix will be available in the coming months.
More in Security
CISA Releases New Free Tool to Identify Threats in Microsoft Cloud Services
Mar 24, 2023 | Rabia Noureen
Microsoft Defender for IoT Gets Cloud-Powered Security Features to Protect Enterprise Networks
Mar 21, 2023 | Rabia Noureen
Azure Firewall Basic Now Available to Protect Small Businesses Against Cyberattacks
Mar 16, 2023 | Rabia Noureen
Microsoft Releases Updates to Patch Critical Outlook NTLM Vulnerability
Mar 16, 2023 | Rabia Noureen
Microsoft Warns About New MFA Bypass Tool Used in AiTM Phishing Campaigns
Mar 15, 2023 | Rabia Noureen
Microsoft 365 Defender Adds Real-Time Custom Detections Support in Preview
Mar 14, 2023 | Rabia Noureen
Most popular on petri