=====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN041
_____________________________________________________________________

DATE                : 15/04/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Server 2012 running
                            Active Directory Federation Services.

======================================================================
KB3045711
https://technet.microsoft.com/en-us/library/security/MS15-040
______________________________________________________________________

Microsoft Security Bulletin MS15-040 - Important Vulnerability in Active
Directory Federation Services Could Allow Information
Disclosure (3045711)

Published: April 14, 2015

Version: 1.0


Executive Summary

This security update resolves a vulnerability in Active Directory
Federation Services (AD FS). The vulnerability could allow information
disclosure if a user leaves their browser open after logging off from
an application and an attacker reopens the application in the browser
immediately after the user has logged off.

This security update is rated Important for AD FS 3.0 when installed on
x64-based editions of Windows Server 2012 R2.

For more information, see the Affected Software section.


Affected Software

Windows Server 2012 R2

Windows Server 2012 R2 (Server Core installation)


Vulnerability Information

Active Directory Federation Services Information Disclosure
Vulnerability - CVE-2015-1638

An information disclosure vulnerability exists when Active Directory
Federation Services (AD FS) fails to properly log off a user. The
vulnerability could allow unintentional information disclosure. An
attacker who successfully exploited this vulnerability could gain
access to a user's information by reopening an application from which
the user has logged off.
Since the logoff actually fails an attacker is not prompted to enter a
username or password. An attacker could then use this vulnerability to
discover information to which an AD FS user has access.

Servers with the AD FS role installed are affected by this
vulnerability. The update addresses the vulnerability by ensuring that
the logoff process properly logs off the user.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that
this vulnerability had been publicly used to attack customers.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================