Skip to main content

Unable to RDP From Windows 7: Encryption Oracle Remediation

By

Remote Desktop Authentication Error Has Occurred. The function requested is not supported.



With the release of the March 2018 Security bulletin, there was a fix that addressed a CredSSP, “Remote Code Execution” vulnerability (CVE-2018-0886) which could impact RDP connections. The vulnerability was discovered to which the exploits observed were:
  • Targets receive a malicious RTF Microsoft Office document
  • After being opened, the malicious document causes the second stage of the exploit to be downloaded in the form of an HTML page with malicious code
  • The malicious code triggers the use-after-free memory-corruption bug
  • Accompanying shellcode then downloads and executes a malicious payload
Symptoms
1.       The VM screenshot shows the OS fully loaded and waiting for the credentials
2.       If you try to RDP the VM either internally or externally, you'll get the message:
An authentication error has occurred.
The function requested is not supported.

This could be due to CredSSP encryption oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660
To discuss further regarding this update please see: General Discussion - Unable to RDP: CredSSP
If the below steps do you help you in resolving your issue please open a new forum post to Azure Virtual Machines

Root Cause Analysis
To resolve a vulnerability issue with Credential Security Support Provider protocol (CredSSP), a monthly Windows update in May was applied which does two things:
1.       Correct how Credential Security Support Provider protocol (CredSSP) validates requests during the authentication process
2.       Change the group policy Encryption Oracle Remediation default setting from Vulnerable to Mitigated.
This RDP authentication issue can occur if the local client and the remote host have differing Encryption Oracle Remediation settings that define how to build an RDP session with CredSSP. If the server or client have different expectations on the establishment of a secure RDP session the connection could be blocked. There is the possibility that the current default setting could change from the tentative update and therefore impact the expected secure session requirement.
Below is the matrix for each possible situation for RDP result: 
xamples: 1.       If the client is updated and you try to RDP to an Azure VM that was not updated, then it will be blocked and see the error message.
2.       If the client is not patched while server is updated, RDP can still work. But the session will be exposed to the attack.
3.       If both client & server are patched with default setting (Mitigated), RDP will work in a secure way.
References:
Resolution/ Fix
Ensure both client & server side have latest patch installed so that RDP can be established in a secure way.
You can find the list of the corresponding KB number for each operating system here: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886

Alternative Work-arounds
Mitigation 1
If you cannot RDP to  VMs from your patched client, we can consider changing the policy settings on the client to temporarily gain RDP access to the servers. You can change the settings in Local Group Policy Editor. Execute gpedit.msc and browse to Computer Configuration / Administrative Templates / System / Credentials Delegation in the left pane: 





Change the Encryption Oracle Remediation policy to Enabled, and Protection Level to Vulnerable:  





Mitigation 2
If it is not possible to access to Local Group Policy Editor on the client (i.e. Windows Home versions), same change can be done through the registry:
REG  ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\ /v AllowEncryptionOracle /t REG_DWORD /d 2

After that, whether the established RDP session is secure or not depends on whether server is patched. Remember to un-do this when all the servers are patched.




Comments

Post a Comment

Popular posts from this blog

Duplicate IP Address has been Detected Rule

By
A duplicate IP address has been detected on the network Rule Knowledgebase Summary This rule generates an alert when Windows® detects that he local machine’s IP address is in conflict with one or more identical IP addresses on the network. Until the IP address conflict is resolved, remote clients and applications may have difficulty accessing resources on any of the effected computers. Additionally, the local computer may not be able to access network resources. Related Events This rule generates an alert whenever the following events occur and are recorded in the System Event Log: The system detected an address conflict for IP address %2 with the system having network hardware address %3. The local interface has been disabled. Source: TCPIP; Event ID: 4198; The system detected an address conflict for IP address %2 with the system having network hardware address %3. The local interface has been disabled. Source: TCP...
1 comment
Read more

Schedule Automatic backup config in Cisco Nexus

By
Schedule Automatic backup config in Cisco Nexus Nexus-Sw1(config)#feature scheduler   //Enable scheduler service in Nexus Nexus-Sw1(config)#scheduler job name backup-daily      // Job Name Nexus-Sw1(config)#scheduler aaa-authentication username abcd password abcd@123     // AAA - Authentication for Job created above (If AAA configured) Nexus-Sw1(config)#scheduler job name backup-daily copy running-config tftp://192.168.1.23/$(SWITCHNAME)-cfg.$(TIMESTAMP)         //IP of TFTP SERVER , file will saved with switch name and timestamp exit Nexus-Sw1(config)#scheduler schedule name backup-daily   // Setup Schedule to run for the JOB Nexus-Sw1(config-schedule)# time ?   daily    Specify a daily schedule   monthly  Specify a monthly schedule   start    Specify a future time schedule   weekly   Specify a weekly schedule...
Post a Comment
Read more

VMware CPU and Memory Reservations: Fixing Insufficient resources to satisfy configured failover level for HA

By
Source Knowledge From :-  http://geekswing.com/geek/vmware-cpu-and-ram-reservations-fixing-insufficient-resources-to-satisfy-configured-failover-level-for-ha/ VMware CPU and Memory Reservations: Fixing Insufficient resources to satisfy configured failover level for HA This post comes from a few days of poring over manuals as well as some technical support. This is a good one. The error came from trying to power on a VM in our VMware cluster and we would get these errors: “Insufficient resources to satisfy configured failover level for HA” And this alert on our cluster “Insufficient resources to satisfy HA failover level on cluster vmCluster in vmTST” Our way of thinking was we had to power one off to power another one on. But that didn’t work. Here we is the actual solution. (p.s. Great VMware HA education for me on this one!) PROBLEM SOURCE: VMware HA is turned on and you are violating constraints VMware HA is turned on, and you have i...
1 comment
Read more