=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN262
_____________________________________________________________________

DATE                : 12/11/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Server 2008, Server 2012, Server
                        Core installation option,
     running Active Directory Federation Services version 2.0, 2.1, 3.0.

======================================================================
KB3003381
https://technet.microsoft.com/library/security/ms14-077
______________________________________________________________________

Microsoft Security Bulletin MS14-077 - Important Vulnerability in Active
Directory Federation Services could allow Information Disclosure (3003381)

Version: 1.0

Published Date: November 11, 2014


General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Active Directory Federation Services (AD FS). The vulnerability could
allow information disclosure if a user leaves their browser open after
logging off from an application, and an attacker reopens the
application in the browser immediately after the user has logged off.


Affected Software

Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Active Directory Federation Services 2.0
Active Directory Federation Services 2.1
Active Directory Federation Services 3.0


Vulnerability Information

Active Directory Federation Services Information Disclosure
Vulnerability - CVE-2014-6331

An information disclosure vulnerability exists when Active Directory
Federation Services (AD FS) fails to properly log off a user. The
vulnerability could allow unintentional information disclosure.
Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that
this vulnerability had been publicly used to attack customers. The
update addresses the vulnerability by ensuring that the logoff process
properly logs out the user.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================