Executive Summary

This vulnerability exists in Canonical ADSys versions through v0.16.2, where the system uses an unencrypted HTTP connection instead of HTTPS to request a CA certificate during Active Directory Certificate Services (AD CS) certificate auto-enrollment.

An unauthenticated attacker on the network can intercept this plaintext HTTP request and supply a malicious Root CA certificate. The system automatically trusts and installs this rogue certificate into its local trust store.

As a result, TLS clients on the affected machine will trust attacker-controlled certificates for any domain, enabling persistent interception and decryption of secure communications.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to system-wide trust store poisoning, allowing an attacker to perform man-in-the-middle attacks on TLS connections.

• An attacker can intercept and decrypt supposedly secure communications.
• The attacker can impersonate arbitrary domains by presenting rogue certificates trusted by the system.
• This compromises confidentiality and integrity of data transmitted over TLS on the affected machine.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for plaintext HTTP requests to the Active Directory Certificate Services (AD CS) server during certificate auto-enrollment. Specifically, look for HTTP requests to URLs similar to 'http://<AD_CS_CA_hostname>/CertSrv/mscep/mscep.dll/pkiclient.exe?'.

Commands to detect this might include using network packet capture tools such as tcpdump or Wireshark to filter HTTP traffic to the AD CS CA hostname.

• tcpdump -i <interface> -A 'tcp port 80 and host <AD_CS_CA_hostname>'
• tshark -Y 'http.request and ip.addr == <AD_CS_CA_IP>' -T fields -e http.host -e http.request.uri

Additionally, inspecting the system trust store for unexpected or attacker-controlled Root CA certificates can help identify if the system has been compromised.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Canonical ADSys software to version v0.16.3 or later, where the vulnerability is fixed by changing the certificate retrieval URL from HTTP to HTTPS.

Until the upgrade is applied, network administrators should ensure that network traffic between the managed Ubuntu hosts and the AD CS server is protected, for example by using network segmentation, VPNs, or other secure tunnels to prevent Man-in-the-Middle attacks.

Additionally, review and remove any suspicious or attacker-controlled Root CA certificates from the local system trust store to prevent trust store poisoning.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated network attacker to perform a Man-in-the-Middle (MITM) attack by intercepting plaintext HTTP requests for CA certificates, resulting in system-wide trust store poisoning. Consequently, TLS clients on the affected system may accept rogue certificates, enabling persistent interception and decryption of TLS connections.

Such a compromise of TLS security can lead to unauthorized access to sensitive data in transit, which may violate security requirements mandated by common standards and regulations like GDPR and HIPAA that require protection of data confidentiality and integrity during transmission.

Therefore, this vulnerability negatively impacts compliance with these standards by undermining the trustworthiness of encrypted communications and potentially exposing protected data to attackers.

Useful 0 Not Useful 0