Description Preview
A vulnerability in UCS@school's LDAP access control lists (ACLs) allows teachers, staff, and school administrators to access sensitive password hash information. The vulnerability exists in the ucs-school-ldap-acls-master component and affects versions prior to 4.4v5-errata. Attackers can use LDAP search requests to read sambaNTPassword, krb5Key, sambaPasswordHistory, and pwhistory attributes. This could allow a teacher to obtain administrator access by leveraging the exposed NTLM hashes.
Overview
This vulnerability (CWE-522: Insufficiently Protected Credentials) occurs due to improper access control configuration in the LDAP directory service of UCS@school. The system incorrectly allows certain user roles (teachers, staff, and school administrators) to access password hash information that should be restricted. By issuing specific LDAP search requests, these users can retrieve password hashes including sambaNTPassword (used for Windows authentication), krb5Key (Kerberos keys), and password history information. With access to these hashes, particularly NTLM hashes, an attacker could potentially escalate their privileges to gain administrator access to the system.
Remediation
- Update UCS@school to version 4.4v5-errata or later which contains the fix for this vulnerability.
- Review and audit LDAP ACL configurations to ensure proper access restrictions are in place.
- Monitor LDAP access logs for unusual query patterns that might indicate exploitation attempts.
- Consider implementing additional authentication factors for administrative accounts to mitigate the risk of compromised password hashes.
- If you suspect compromise, reset passwords for all administrative accounts and review system logs for unauthorized access.
References
- Univention Bugzilla: https://forge.univention.org/bugzilla/show_bug.cgi?id=50669
- CWE-522: Insufficiently Protected Credentials - https://cwe.mitre.org/data/definitions/522.html
- MITRE CVE-2020-17477 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17477
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
