Mitigation Strategies

To mitigate this vulnerability, you should update Dynatrace OneAgent to version 1.325 or later, as this version includes a fix addressing the security issue related to NTLM hash exposure during network share detection. [1]

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Dynatrace OneAgent versions before 1.325.47. When the agent attempts to access a remote network share and encounters a STATUS_LOGON_FAILURE error, it retrieves every user token on the machine and repeatedly tries to access the network share while impersonating those users. This behavior can be exploited by an unprivileged attacker with access to the affected system to perform NTLM relay attacks. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an unprivileged attacker who has access to the affected system to perform NTLM relay attacks. This means the attacker could potentially impersonate other users on the machine to gain unauthorized access to network resources, leading to possible data breaches or unauthorized actions within the network. [1]

Useful 0 Not Useful 0