Microsoft Kerberos & NetLogon Changes November 8, 2022 Announcements

[George_Casper]

Does Checkpoint have any response with compatibility guidelines or issues regarding Microsoft's Kerberos & NetLogon changes announced today?   See links below.  Anything with Identity Awareness, Identity Connector, LDAP Lookup & VPN Authentication, etc...? 

• KB5020805: How to manage Kerberos protocol changes related to CVE-2022-37967
• KB5021130: How to manage Netlogon protocol changes related to CVE-2022-38023
• KB5021131: How to manage the Kerberos protocol changes related to CVE-2022-37966

[PhoneBoy]

To the best of my knowledge, the only thing that MIGHT be impacted is transparent (browser) auth via Identity Awareness.
@Royi_Priov would know for sure.

[Liel_Shaish]

Hi,

Identity Awareness Kerberos flows and AD-Query were analyzed and tested. No issues were found or reported.
We are still missing an indication on Microsoft side that configuration was applied correctly. We will try to verify it with Microsoft support.  

Thanks,
Liel Shaish, RnD Group Manager 

[EmanueleM]

Good morning Liel, can you officially confirm that there are no potential issues?

Best regards

Emanuele

[Wolfgang]

Are there any news regarding this issue ? How about SSO authentication via Kerberos with Identity Agent on windows machine ? Are we safe without changes ?

[EmanueleM]

Hi Wolfgang, last week I opened a SR to Check Point support and this was their answer:

Official response from RnD:
According to the R & D team, CVE-2022-38023 and  CVE-2022-37967 are part of Microsoft configuration (Kerberos server and windows server). Checkpoint gateways are not affected by these protocol changes. The only blade which listens to such traffic is Identity Awareness. The identity Awareness blade was analyzed and tested  in response to Protocol Change CVE-2022-38023 and CVE-2022-37967 and no issues were found or reported

Regards