CVE-2021-33779HighCVSS 8.1
Windows AD FS Security Feature Bypass Vulnerability
🔗 CVE IDs covered (1)
📋 Description
What kind of security feature could be bypassed by successfully exploiting this vulnerability? This vulnerability relates to Primary Refresh Tokens which are usually stored in TPM. These tokens are usually used for SSO for Azure AD accounts. The tokens are not encrypted in a strong enough manner, and an administrator with access to a vulnerable system could extract and potentially decrypt the token for reuse until the token expires or is renewed.
🎯 Affected products6
- Windows Server 2016
- Windows Server 2016 (Server Core installation)
- Windows Server 2019
- Windows Server 2019 (Server Core installation)
- Windows Server, version 2004 (Server Core installation)
- Windows Server, version 20H2 (Server Core Installation)
✅ Remediation
KB5004244 (Security Update) — fixed build 10.0.17763.2061 KB5004237 (Security Update) — fixed build 10.0.19041.1110 KB5004237 (Security Update) — fixed build 10.0.19042.1110 KB5004238 (Security Update) — fixed build 10.0.14393.4530
🔗 References (7)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33779
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5004244
- referencehttps://support.microsoft.com/help/5004244
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5004237
- referencehttps://support.microsoft.com/help/5004237
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5004238
- referencehttps://support.microsoft.com/help/5004238