Microsoft · Windows Lightweight Directory Access Protocol · CVE-2024-49112
**Name of the Vulnerable Software and Affected Versions**
Windows Lightweight Directory Access Protocol (LDAP) versions prior to the fixed version
**Description**
The vulnerability is related to an integer overflow in the Windows Lightweight Directory Access Protocol (LDAP) service, allowing remote attackers to execute arbitrary code and affect the system. An unauthenticated attacker can exploit this flaw by sending a specially crafted set of LDAP calls to the server, leading to arbitrary code execution. The estimated number of potentially affected devices worldwide is not explicitly mentioned, but the vulnerability has a high CVSS score, indicating a significant risk. There is no information about real-world incidents where this issue was exploited.
**Recommendations**
To resolve the issue, apply the patch immediately, as Microsoft's December 2024 Patch Tuesday addresses this flaw. Additionally, monitor networks for anomalous LDAP traffic, DNS SRV queries, and CLDAP responses. Restrict access to the vulnerable LDAP service to minimize the risk of exploitation. Ensure that inbound RPC connections are only allowed from trusted internal networks, and verify that domain controllers do not have direct access to the internet. Use tools or scripts to check the system for vulnerable configurations and monitor LDAP and RPC traffic for suspicious activity.