LDAPNightmare
- Product
- Microsoft Windows LDAP client (wldap32.dll)
- CVE
- CVE-2024-49112CVE-2024-49113
- Disclosed
- 2024-12-10
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- All supported Windows client and server versions (including domain controllers) prior to December 2024 updates.
- Fixed
- December 2024 Patch Tuesday cumulative updates.
Summary
An integer overflow in the Windows LDAP client code that can be triggered when a Windows host processes a malicious LDAP referral response. A remote attacker can make a domain controller or server look up an attacker-controlled domain via CLDAP and then serve a crafted reply.
Root cause
wldap32.dll does not correctly validate a length value while parsing LDAP referral results from a CLDAP response, producing an integer overflow. SafeBreach showed the sibling bug CVE-2024-49113 (an out-of-bounds read in the same referral path) can be triggered remotely via a DsrGetDcNameEx2 Netlogon RPC call that forces the victim to query an attacker DNS/CLDAP server.
Impact
Unauthenticated RCE (CVE-2024-49112) or crash of LSASS and reboot of unpatched domain controllers (CVE-2024-49113).
Detection
Check for missing December 2024 updates. Watch for unusual outbound CLDAP (UDP/389) and DNS SRV lookups from domain controllers to external domains, and suspicious Netlogon RPC calls.
Mitigation
Apply the December 2024 updates. Until then, block DCs from making outbound RPC, DNS and LDAP connections to the internet.