Headline

CVE-2020-3427: Duo Authentication for Windows Logon and RDP - Release Notes

The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows Logon, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. Note that this can only exploitable during new installations while the installer is running and is not exploitable once installation is finished. Versions 4.1.2 of Windows Logon addresses this issue.

4 years ago

CVE

Open in Source

#vulnerability #ios #mac #windows #microsoft #dos #perl #auth

Duo integrates with Microsoft Windows client and server operating systems to add two-factor authentication to Remote Desktop and local logons.

Download the current release from the Checksums and Downloads page.

Version 4.2.0 - September 23, 2021

Introduces remembered devices for local Windows logins. The Remembered Devices policy for Duo MFA, Access, and Beyond plan customers now includes settings for Windows Logon. Remembering the device during online authentication creates a trusted session, letting users skip Duo two-factor authentication for the lifetime of the session.
Adds the hostname of the system where Duo for Windows Logon is installed to Duo Mobile push requests and the Windows logon authentication type (Local, RDP, UAC) to Duo Push request notifications.
Adds support for Windows 11 and Windows Server 2022.
Bug fixes.

Version 4.1.3 - November 2, 2020

Fixes an issue with Duo Windows Logon installer that may cause a MSI self-repair and subsequent “Installation stopped” error from Duo Windows Logon Installer. Customers upgrading from 4.1.2 may still experience unexpected MSI self repairs during installation. Refer to Duo KB article 6462 for additional remediation steps.

Version 4.1.2 - October 14, 2020

Addresses an elevation of privilege vulnerability in the Windows Logon installer which could allow an authenticated local attacker to overwrite files in privileged directories (CVE-2020-3427). The vulnerability was limited to the installer only, and did not affect the application once installed.

Version 4.1.1 - July 13, 2020

Updated installer to remove the password check that contributed to user lockouts in v4.1.0 when installed on Active Directory Domain Controllers. Customers with v4.1.0 installed should upgrade to v4.1.1 at the earliest opportunity.

Version 4.1.0 - April 29, 2020

There is a known issue with installation of Duo Authentication for Windows Logon and RDP version 4.1 on Active Directory domain controllers that may trigger user lockouts.

Introduces User Elevation, which adds the 2FA Duo prompt for credentialed User Account Control.
GPO template updated to include User Elevation configuration.
SHA-256 signed installer.
Additional bug fixes and security enhancements

Version 4.0.7 - October 2019

Fixes an issue related to multiple in-flight authentications.
Support for Windows Server 2008 R2 and Windows 7 ends in January 2020. Future releases may not function on unsupported operating systems.

Version 4.0.6 - September 2019

Added a support tool that sanitizes and packages config and log files into a zip file you can send to Duo Support when troubleshooting issues.
Added log file rotation.
Added additional UI installer options for HTTP proxy settings.
Updated GPO template to include log file rotation and Offline Authentication configuration.
Removed .NET dependency for the installer connectivity check.
Fixed a bug that would result in “Ordinal Not Found” being displayed in certain scenarios.
Fixed the flow of windows password changes that could cause re-enrollment in Offline Authentication.
Removed errant log message stating "Duo Auth Not Configured".
Response to CERT/CC Vulnerability Note VU#576688.
Security improvements for Offline Authentication.
Additional bug fixes and security enhancements.

Version 4.0.5 - April 2019

Correct issue enforcing secure failmode (FailOpen=0) when the Offline Access feature is disabled at the client system (OfflineAvailable=0). PSA-2019-001 (CVE-2019-11237)

Version 4.0.3 - February 2019

Corrected issue with installer not preserving configured options on upgrade.

Version 4.0.2 - February 2019

Corrected an issue with offline access de-provisioning registered users unexpectedly after a bypass login.
Installer dialog changes for integration and smart card options.
Command line installer now permits setting all configuration options.
Fixed issues with installer product codes that affected MSI in-place upgrades.

Version 4.0.1 - December 2018

UsernameFormatForService setting now respected when set via GPO.
Bug fixes.

Version 4.0.0 - November 2018

Introduces offline access with Duo MFA.
Adds support for Windows Server 2019. Deprecates support for Windows 8 and 2008.
Now includes the Windows hostname of the system where Duo is installed in the Duo authentication logs for both remote and local console logins.
Bug fixes

Version 3.1.2 - May 2018

Installer improvements, including a new API connectivity check

Version 3.1.1 - October 2017

Supports chaining Duo authentication with smart card logon
Configurable username format for Duo now supports userPrincipalName (UPN)
Bug fixes

Version 3.1.0 - July 2017

Support for wrapped credential providers
Permits an allow list of third-party credential providers
Configurable Duo username format sAMAccountName or NTLM name (msDS-PrincipalName)
Silent MSI command line upgrade

Version 3.0.0.85 - February 2017

New authentication prompt UI
Dropped active support for Windows Vista

Version 2.1.0 - September 2016

Added option to allow smart card authentication
Windows Server 2016 support

Version 2.0.0.71 - February 2016

Added HTTP proxy of Duo authentication traffic only
Supports configuration via Group Policy

Version 1.2.0.14 - August 2015

Windows 10 support

Version 1.1.8 - September 2014

Last release with support for Windows 2003 and XP.
Improved handling of UPN usernames
Adjustment to authentication attempt timeout logic
Bugfixes

Version 1.1.7 - April 2014

Ensured that the secondary login window always appears on Server 2012, Windows 8, and newer

Version 1.1.6 - April 2014

Fixed upgrades using .msi installers in headless mode

Version 1.1.5 - March 2014

Fixed log on to domain accounts on offline workstations
Fixed log on to domain accounts with usernames that match local accounts

Version 1.1.4 - Jan 2014

Bugfixes

Version 1.1.3 - Jan 2014

Fixed double-prompt for username/password when logging into Windows 7 / Server 2008 R2 (or newer) with an RDP client supporting Network-Level Authentication

Version 1.1.2 - Oct 2013