As a part of the December 2012 security update release, Microsoft included a fix to address a security vulnerability in IP-HTTPS, an important component used in DirectAccess on Windows Server 2012. IP-HTTPS is an IPv6 transition protocol that utilizes SSL/TLS to tunnel IPv6 traffic from the DirectAccess client to the DirectAccess server. This vulnerability could potentially allow a DirectAccess client to connect to a Windows Server 2012 DirectAccess server with a revoked computer certificate. It is important to understand that this vulnerability would not grant the DirectAccess client full access to the corporate network unless the DirectAccess client also had an active computer account and the user provided valid domain credentials. Best practices dictate that a lost or stolen DirectAccess computer should have its computer account disabled in addition to revoking its computer certificate. You can find additional information about this vulnerability here.
Awards
Pluralsight
Consulting
Newsletter
- My Tweets
- 6to4
- AADJ
- Absolute
- Absolute Secure Access
- Absolute Software
- Active Directory
- ADC
- administration
- Always On VPN
- Always On VPN Book
- Always On VPN DPC
- Amazon EC2
- Amazon Web Services
- AOVPN
- AOVPN Book
- AovpnDPC
- application delivery controller
- Application Filter
- authentication
- AWS
- Azure
- Azure Active Directory
- Azure AD
- Azure AD Join
- Azure Application Gateway
- Azure Conditional Access
- Azure Load Balancer
- Azure MF
- Azure MFA
- Azure Traffic Manager
- Azure Virtual WAN
- Azure VPN
- Azure VPN Gateway
- BIG-IP
- certificates
- Cisco
- Cisco Umbrella
- Cisco Umbrella Roaming Client
- Citrix ADC
- cloud
- Cloudflare
- Compliance
- Conditional Access
- Consulting Services
- Cryptography
- Deployment
- Device Management
- device tunnel
- DirectAccess
- DirectAccess Book
- DirectAccess Deprecated
- DirectAccess End of Life
- DirectAccess EOL
- DNS
- DNS Policies
- DPC
- Dynamic Profile Configurator
- EAP
- EC2
- ECC
- education
- Elliptic Curve Cryptography
- encapsulation
- Encryption
- end of life
- Endpoint Manager
- Enterprise
- enterprise mobility
- EOL
- extensible authentication protocol
- F5
- force tunnel
- force tunneling
- Forefront TMG 2010
- Forefront UAG 2010
- General
- Geographic Redundnacy
- GitHub
- Group Policy
- HAADJ
- High Availability
- Hotfix
- Hybrid Azure AD Join
- IKEv2
- iManage
- Important Links
- Infrastructure
- InTune
- Intune Certificate Connector
- Intune PFX Connector
- IP-HTTPS
- IPv6
- IPv6 Transition
- ISATAP
- Kemp
- learning
- Load Balancing
- LoadMaster
- local traffic manager
- LTM
- Manage Out
- MDM
- MEM
- MEMCM
- MFA
- Microsoft
- Microsoft Endpoint Manager
- Microsoft Intune
- Mobile Device Management
- Mobility
- Multifactor Authentiction
- multisite
- MVP
- NAC
- Name Resolution
- name resolution policy table
- NAP
- NCA
- NCSI
- NDES
- NetMotion
- NetMotion Mobility
- NetMotion Software
- Netscaler
- Network Access Control
- network connectivity assistant
- network connectivity status indicator
- Network Device Enrollment Service
- Network Device Enrollment Services
- network policy server
- nmap
- NPS
- NRPT
- Offline Domain Join
- OMA-DM
- OpenDNS
- OpenSSL
- OpenVPN
- Operational Support
- OTP
- PEAP
- PFX Connector
- PKI
- Pluralsight
- PointSharp
- PowerShell
- Professional Services
- ProfileXML
- Protected EAP
- Proxy
- Proxy Server
- public cloud
- public key infrastructure
- Quad9
- Recommended Reading
- Remote Access
- reporting
- routing
- routing and remote access service
- RRAS
- SCCM
- SCEP
- Secure Socket Tunneling Protocol
- Security
- Simple Certificate Enrollment Protocol
- Split DNS
- split tunnel
- split tunneling
- SSL
- SSL and TLS
- SSTP
- Surface Pro
- Surface Pro 4
- System Center 2012
- System Center Configuration Manager
- systems management
- Teredo
- TLS
- TLS 1.3
- TPM
- Traffic Filter
- Training
- transition technology
- Transport Layer Security
- troubleshooting
- Trusted Platform Module
- Uncategorized
- Update
- user tunnel
- video
- Visual Studio
- Visual Studio Code
- VPN
- VPN Proxy
- VS Code
- Vulnerability
- Web Application Proxy
- Web Proxy
- Web Proxy Server
- webinar
- Windows 10
- Windows 11
- Windows 7
- Windows 8
- Windows 8.1
- Windows Server 2008 R2
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- WorkSite
- XML
- Zero Trust
- Zero Trust Network Access
- Zscaler
- ZTNA
Windows Server 2012 DirectAccess IP-HTTPS Security Vulnerability
Posted by Richard M. Hicks on December 12, 2012
https://directaccess.richardhicks.com/2012/12/12/windows-server-2012-directaccess-ip-https-security-vulnerability/
Always On VPN Book
DirectAccess Book
Always On VPN DPC
-
Recent Posts
Always On VPN Resources
DirectAccess Resources
Active Directory ADC Always On VPN AOVPN application delivery controller authentication Azure book bug CA certificate certificates Certification Authority cloud configuration device tunnel DirectAccess DNS education encryption enterprise mobility error F5 firewall Forefront Forefront UAG Forefront UAG 2010 GPO group policy high availability hotfix IKEv2 Important Links InTune IP-HTTPS IPsec IPv6 IPv6 transition technology Kemp learning load balancer load balancing LoadMaster management Manage Out MDM MEM Microsoft Microsoft Endpoint Manager Microsoft Intune Mobility multisite NetMotion NetMotion Mobility Networking network location server network policy server NLB NLS NPS NRPT OTP performance PKI PowerShell ProfileXML public cloud RasClient redundancy Remote Access routing routing and remote access service RRAS scalability SCCM security Server 2012 SSL SSTP System Center Configuration Manager Teredo TLS training troubleshooting UAG update user tunnel VPN Windows Windows 7 Windows 8 Windows 10 Windows 11 Windows Server Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 XML