topic Re: Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements in General Topics

Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

George_Casper — Wed, 09 Nov 2022 08:27:53 GMT

Does Checkpoint have any response with compatibility guidelines or issues regarding Microsoft's Kerberos & NetLogon changes announced today? See links below. Anything with Identity Awareness, Identity Connector, LDAP Lookup & VPN Authentication, etc...?

Re: Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

PhoneBoy — Thu, 10 Nov 2022 01:51:17 GMT

To the best of my knowledge, the only thing that MIGHT be impacted is transparent (browser) auth via Identity Awareness.
@Royi_Priov would know for sure.

Re: Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

Liel_Shaish — Mon, 14 Nov 2022 13:34:31 GMT

Hi,

Identity Awareness Kerberos flows and AD-Query were analyzed and tested. No issues were found or reported.
We are still missing an indication on Microsoft side that configuration was applied correctly. We will try to verify it with Microsoft support.

Thanks,
Liel Shaish, RnD Group Manager

Re: Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

EmanueleM — Thu, 30 Mar 2023 09:36:03 GMT

Good morning Liel, can you officially confirm that there are no potential issues?

Best regards

Emanuele

Re: Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

Wolfgang — Mon, 03 Apr 2023 07:59:56 GMT

Are there any news regarding this issue ? How about SSO authentication via Kerberos with Identity Agent on windows machine ? Are we safe without changes ?

Re: Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

EmanueleM — Mon, 03 Apr 2023 09:07:20 GMT

Hi Wolfgang, last week I opened a SR to Check Point support and this was their answer:

Official response from RnD:
According to the R & D team, CVE-2022-38023 and CVE-2022-37967 are part of Microsoft configuration (Kerberos server and windows server). Checkpoint gateways are not affected by these protocol changes. The only blade which listens to such traffic is Identity Awareness. The identity Awareness blade was analyzed and tested in response to Protocol Change CVE-2022-38023 and CVE-2022-37967 and no issues were found or reported

Regards