topic Re: Block outbound NTLM auth in General Topics

Block outbound NTLM auth

DPoppleton — Fri, 13 Apr 2018 12:36:38 GMT

With CVE-2018-0950 from Microsoft, if an outlook user clicks on an OLE object in an RTF email, the client will send credentials try to logon. Our security group is quite concerned about this.

While allowing ports 445, 137 and 139 out to the internet is a really bad idea, they want to make sure that it is explicitly blocked. Is the application "ms-netlogon" the app to block? It includes many more ports than just the three mentioned above. Is anyone else doing this? Are 'we' just overreacting?

Re: Block outbound NTLM auth

Brandon_Wertz — Fri, 13 Apr 2018 18:41:59 GMT

I would think that your firewall policy would already be preventing that application; either by default or exception.

If not, I don't think it would be over-reacting to ensure it's blocked.

Re: Block outbound NTLM auth

BPry — Fri, 13 Apr 2018 20:03:14 GMT

@DPoppleton,

I would probably just ensure that 445, 137, 139 are blocked to the untrust interface. I wouldn't even do this by app-id unless you need those ports open for something else to function correctly. As @Brandon_Wertz already pointed out, this shouldn't be allowed by your configuration anyways.