Knowledgebase: Dedicated Servers
Unable to RDP : CredSSP Encryption Oracle Remediation
Posted by on 06 June 2018 12:47 PM

Overview

With the release of the March 2018 Security bulletin, there was a fix that addressed a CredSSP, “Remote Code Execution” vulnerability (CVE-2018-0886) which could impact RDP connections. The vulnerability was discovered to which the exploits observed were:

  • Targets receive a malicious RTF Microsoft Office document
  • After being opened, the malicious document causes the second stage of the exploit to be downloaded in the form of an HTML page with malicious code
  • The malicious code triggers the use-after-free memory-corruption bug
  • Accompanying shellcode then downloads and executes a malicious payload

Symptoms

1.       The VM screenshot shows the OS fully loaded and waiting for the credentials

2.       If you try to RDP the VM either internally or externally, you'll get the message:

"An authentication error has occurred."

"The function requested is not supported."

"This could be due to CredSSP encryption oracle remediation.

For more information, see https://go.microsoft.com/fwlink/?linkid=866660"

 

Root Cause Analysis

To resolve a vulnerability issue with Credential Security Support Provider protocol (CredSSP), a monthly Windows update in May was applied which does two things:

1.       Correct how Credential Security Support Provider protocol (CredSSP) validates requests during the authentication process

2.       Change the group policy Encryption Oracle Remediation default setting from Vulnerable to Mitigated.

This RDP authentication issue can occur if the local client and the remote host have differing Encryption Oracle Remediation settings that define how to build an RDP session with CredSSP. If the server or client have different expectations on the establishment of a secure RDP session the connection could be blocked. There is the possibility that the current default setting could change from the tentative update and therefore impact the expected secure session requirement.

Below is the matrix for each possible situation for RDP result:

 

Examples:

1.       If the client is updated and you try to RDP to an Azure VM that was not updated, then it will be blocked and see the error message.

2.       If the client is not patched while server is updated, RDP can still work. But the session will be exposed to the attack.

3.       If both client & server are patched with default setting (Mitigated), RDP will work in a secure way.

 

Resolution/ Fix

Ensure both client & server side have latest patch installed so that RDP can be established in a secure way.

Alternative Work-arounds

Mitigation 1

If you cannot RDP to VMs from your patched client, we can consider changing the policy settings on the client to temporarily gain RDP access to the servers. You can change the settings in Local Group Policy Editor. Execute gpedit.msc and browse to Computer Configuration / Administrative Templates / System / Credentials Delegation in the left pane:

Change the Encryption Oracle Remediation policy to Enabled, and Protection Level to Vulnerable:

(0 vote(s))
Helpful
Not helpful

Comments (0)
Copyright © 1998 - 2021 Shinjiru International Inc. All Rights Reserved.