7.1 - KB2862152

What is the scope of the advisory?
The purpose of this advisory is to notify customers that Microsoft is publishing an update for DirectAccess and IPsec to address the vulnerability described in this advisory. This vulnerability affects the operating systems that are listed in the Affected Software section.

What might an attacker use the vulnerability to do?
In most scenarios, an attacker who successfully exploited this vulnerability could gain access to any of the information that the targeted system sends over the network. The type of information that could be exposed is not limited to sensitive unencrypted data, but in some cases could also include user authentication information.

How could an attacker exploit the vulnerability?
An attacker-controlled system could pose as a legitimate DirectAccess server by installing a specially crafted server certificate. A targeted system would not be able to discern the attacker's DirectAccess server from a legitimate one.

Will Microsoft issue any further update to address this vulnerability?
No. Microsoft is not planning to release an update in addition to the one released with this advisory.

What does the update do?
The update prevents an attacker-controlled system from being able to pose as a legitimate DirectAccess server without a valid certificate issued by the owning organization. However, the update alone is not enough to fully protect customers from the vulnerability addressed in this advisory. In addition to applying the 2862152 update, customers must also follow the configuration guidance provided in Microsoft Knowledge Base Article 2862152 to be fully protected from the vulnerability.

What additional guidance must customers follow in order to be protected from the vulnerability?
The nature of the fix requires that an enterprise that has DirectAccess server deployed create new server certificates and deploy these new certificates to their DirectAccess server and client systems. If these new certificates are not installed before the update is deployed, the DirectAccess services will remain insecure. See Microsoft Knowledge Base Article 2862152 for the additional configuration steps required for full protection from the vulnerability.

Apply the update for affected releases of Microsoft Windows

The majority of customers have automatic updating enabled and will not need to take any action because the 2862152 update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install the 2862152 update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service. For more information on how to manually apply the update, see Microsoft Knowledge Base Article 2862152.

Note In addition to installing the update, additional administrative steps are required to be protected from the vulnerability described in this advisory. See Microsoft Knowledge Base Article 2862152 for detailed guidance.