{"id":8869,"date":"2019-06-17T06:21:03","date_gmt":"2019-06-17T06:21:03","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=8869"},"modified":"2026-04-17T18:07:52","modified_gmt":"2026-04-17T18:07:52","slug":"windows-ntlm-tampering-vulnerability-cve-2019-1040-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/windows-ntlm-tampering-vulnerability-cve-2019-1040-threat-alert\/","title":{"rendered":"Windows NTLM Tampering Vulnerability (CVE-2019-1040) Threat Alert"},"content":{"rendered":"


\n<\/p>\n

1 Vulnerability Overview<\/strong><\/h2>\n

On June 12, 2019, Beijing time, Microsoft released security patches for the Windows NTLM tampering vulnerability (CVE-2019-1040), which exists in Windows operating systems and allows attackers to bypass the NTLM MIC (Message Integrity Check) protection.<\/p>\n

NTLM Relay is an attack technique used in domain environments. To counter this type of attacks, Windows employs a signing mechanism. To ensure that NTLM messages are not tampered with by attackers in the negotiation phase, Windows appends a field, that is, MIC, in the NTLM authentication message. However, the said vulnerability could render this field useless, thus allowing attackers to bypass the MIC protection.<\/p>\n

Reference:<\/p>\n

https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-1040<\/p>\n

2 Scope of Impact<\/strong><\/h2>\n