Windows NTLM Tampering Vulnerability (CVE-2019-1040) Threat Alert

1 Vulnerability Overview

On June 12, 2019, Beijing time, Microsoft released security patches for the Windows NTLM tampering vulnerability (CVE-2019-1040), which exists in Windows operating systems and allows attackers to bypass the NTLM MIC (Message Integrity Check) protection.

NTLM Relay is an attack technique used in domain environments. To counter this type of attacks, Windows employs a signing mechanism. To ensure that NTLM messages are not tampered with by attackers in the negotiation phase, Windows appends a field, that is, MIC, in the NTLM authentication message. However, the said vulnerability could render this field useless, thus allowing attackers to bypass the MIC protection.

Reference:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1040

2 Scope of Impact

• Affected Versions
• Windows 10 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1703 for 32-bit Systems
• Windows 10 Version 1703 for x64-based Systems
• Windows 10 Version 1709 for 32-bit Systems
• Windows 10 Version 1709 for ARM64-based Systems
• Windows 10 Version 1709 for x64-based Systems
• Windows 10 Version 1803 for 32-bit Systems
• Windows 10 Version 1803 for ARM64-based Systems
• Windows 10 Version 1803 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1903 for 32-bit Systems
• Windows 10 Version 1903 for ARM64-based Systems
• Windows 10 Version 1903 for x64-based Systems
• Windows 7 for 32-bit Systems Service Pack 1
• Windows 7 for x64-based Systems Service Pack 1
• Windows 8.1 for 32-bit systems
• Windows 8.1 for x64-based systems
• Windows RT 8.1
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for Itanium-Based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2016
• Windows Server 2016 (Server Core installation)
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server, version 1803 (Server Core Installation)
• Windows Server, version 1903 (Server Core installation)

3 Detection Method

All systems that are within the affected scope and not installed with the latest patches are vulnerable. Users can check whether the current system has been patched and determine whether it is vulnerable accordingly. The procedure is as follows:

• Step 1 Press Win + R, type control in the Run window, and press Enter.

• Step 2 In the Control Panel window, click Programs.

• Step 3 Click View installed updates under Programs and Features.

• Step 4 In the text box in the upper-right corner, type the KB number. If no program is displayed, the current system is vulnerable. For a detailed list of KB numbers for different operating system versions, see appendix A Official Patch Download Links.

—-End

4 Vulnerability Protection

4.1 Official Patches

Microsoft has released security updates to fix this vulnerability. Users are advised to download and install them as soon as possible. There are three methods to obtain and install patches: intranet WSUS, Microsoft Update service available on Microsoft’s official website, and offline installation.

Note: To immediately start Windows Update, users can type wuauclt.exe /detectnow at the command line prompt.

• Intranet WSUS

Applicability: This method is applicable to computers that are in the Active Directory domain where the WSUS server is available, or computers that have access to the intranet WSUS service.

The system automatically downloads new security patches in a regular manner and prompts users to install them. What users need to do is install these patches as prompted.

To make a patch take effect immediately, users can restart their computers as soon as the installation is complete.

• Microsoft Update Service Available on Microsoft’s Official Website

Applicability: This method is applicable to computers that can connect to the Internet, but have no access to the intranet WSUS service, including those with the intranet WSUS service disabled and those that have this service enabled, but have no access to the intranet.

If the intranet WSUS service is not enabled on computers, users should first enable it and then install patches and restart the computer as prompted.

If computers have the intranet WSUS service enabled, but do not connect to the intranet, users should do as follows: Choose Start > All Programs > Windows Update, click Check online for updates from Microsoft Update, and then do as prompted.

• Offline Installation

With this method, users need to first download the latest patch for the current system, and then double-click the installation package to install it. For download links, see appendix A Official Patch Download Links.

• Official Patch Download Links

• Miscellaneous

• Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

• About NSFOCUS

NSFOCUS IB is a wholly owned subsidiary of NSFOCUS, an enterprise application and network security provider, with operations in the Americas, Europe, the Middle East, Southeast Asia and Japan. NSFOCUS IB has a proven track record of combatting the increasingly complex cyber threat landscape through the construction and implementation of multi-layered defense systems. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide unified, multi-layer protection from advanced cyber threats.

For more information about NSFOCUS, please visit:

https://www.nsfocusglobal.com.

NSFOCUS, NSFOCUS IB, and NSFOCUS, INC. are trademarks or registered trademarks of NSFOCUS, Inc. All other names and trademarks are property of their respective firms.