Microsoft Security Advisory (973811)

Purpose of Advisory: This advisory was released to announce to customers the release of a non-security update to make available a new feature, Extended Protection for Authentication, on the Windows platform.

Advisory Status: Advisory published.

Recommendation:Review the suggested actions and configure as appropriate.

This advisory announces the release of this feature for the following platforms.

What is the scope of the advisory?
Microsoft released this advisory to announce the release of a new feature, Extended Protection for Authentication, as an update to the Windows SSPI to help address credential forwarding.

Is this a security vulnerability that requires Microsoft to issue a security update?
No, this is not a security vulnerability that requires Microsoft to issue a security update. This feature requires optional configuration that some customers may choose to deploy. Enabling this feature is not appropriate for all customers. For more information about this feature and how to appropriately configure it, see Microsoft Knowledge Base Article 973811. This feature is already included in Windows 7 and Windows Server 2008 R2.

What is Extended Protection for Windows Authentication?
The update in Microsoft Knowledge Base Article 968389 modifies the SSPI in order to enhance the way Windows authentication works so that credentials are not easily forwarded when Integrated Windows Authentication (IWA) is enabled.

When Extended Protection for Authentication is enabled, authentication requests are bound to both the Service Principal Names (SPN) of the server the client attempts to connect to and to the outer Transport Layer Security (TLS) channel over which the IWA authentication takes place. This is a base update which enables applications to opt in to the new feature.

Future updates will modify individual system components that perform IWA authentication so the components use this protection mechanism. Customers must install both the Microsoft Knowledge Base Article 968389 update and the respective application-specific updates for the client applications and servers on which Extended Protection for Authentication needs to be activated. Upon installation, Extended Protection for Authentication is controlled on the client through the use of registry keys. On the server, configuration is specific to the application.

What other actions is Microsoft taking to implement this feature?

Changes must be made to the specific server and client applications which use Integrated Windows Authentication (IWA) to ensure they opt in to this new protection technology.

The updates released by Microsoft on August 11, 2009 are:

The update released by Microsoft on October 13, 2009 is:

Microsoft is planning to extend coverage by releasing future updates which will include additional Microsoft server and client applications into these protection mechanisms. This security advisory will be revised to contain updated information when such updates are released.

How can developers embed this protection technology in their applications?

Developers can find more information on how to use Extended Protection for Authentication technology in the following MSDN article, "Integrated Windows Authentication with Extended Protection".

How do I enable this feature?

On the client, customers must implement the following registry key settings.

Detailed instructions on enabling this registry key can be found in Microsoft Knowledge Base Article 968389.

On the server, Extended Protection for Authentication must be enabled on a per-service basis. The following overview shows how to enable Extended Protection for Authentication on the common protocols for which it is currently available:

Telnet (KB 960859)

For Telnet, Extended Protection for Authentication can be enabled on the server by creating the DWORD registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\ExtendedProtection. The default value of this key is Legacy. Set the key to one of the following values:

Detailed instructions on creating this registry key can be found in Microsoft Knowledge Base Article 960859.

What should I be aware of when deploying Extended Protection for Authentication?

Customers must install the update contained in Microsoft Knowledge Base Article 968389, install the respective application updates on client and server computers, and correctly configure both computers to use the protection mechanism in order to be protected against credential forwarding attacks.

When Extended Protection for Authentication is enabled on the client side, it is enabled for all applications using IWA. However, on the server it needs to be enabled on a per-application basis.

Why is this not a security update that is announced in a security bulletin? 
This update implements a new feature which may not be appropriate for all customers to enable. It provides an additional security feature which customers may choose to deploy based on their specific scenario.

This is a security advisory about a non-security update. Isn’t that a contradiction? 
Security advisories address security changes that may not require a security bulletin but may still affect customer’s overall security. Security advisories are a way for Microsoft to communicate security-related information to customers about issues that may not be classified as vulnerabilities and may not require a security bulletin, or about issues for which no security bulletin has been released. In this case, we are communicating the availability of an update that does not address a specific security vulnerability; rather, it addresses your overall security.

How is this update offered? 
These updates are available on the Microsoft Download Center. Direct links to the updates for specific affected software are listed in the Affected Software table in the Overview section. For more information about the update and the changes to behavior, see Microsoft Knowledge Base Article 968389.

Is this update distributed on Automatic Update? 
Yes. These updates are distributed over the Automatic Update mechanism.

What versions of Windows are associated with this advisory? 
The feature addressed in this advisory is being made available for all platforms listed in the Affected Software summary. This feature is present in all releases of Windows 7 and Windows Server 2008 R2.