{"id":11814,"date":"2025-01-03T11:11:35","date_gmt":"2025-01-03T10:11:35","guid":{"rendered":"https:\/\/www.infordisa.com\/soc\/?p=11814"},"modified":"2025-08-18T13:15:39","modified_gmt":"2025-08-18T11:15:39","slug":"vulnerabilidad-critica-ldap-en-servidores-windows","status":"publish","type":"post","link":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/","title":{"rendered":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
Crítica <\/span>\"Alerta<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
CVE-2024-49112<\/a><\/strong><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Descripción<\/h2>

Una vulnerabilidad<\/a> crítica en el cliente LDAP<\/strong> de Windows que según Microsoft permite DoS<\/a><\/strong> y la ejecución remota de código<\/strong>. El exploit<\/a> aprovecha la vulnerabilidad para bloquear los sistemas Windows Server de destino mediante la interacción con su Netlogon Remote Protocol (NRPC)<\/strong>, y el cliente LDAP<\/strong>.<\/p>

El atacante envía una solicitud DCE\/RPC<\/strong> a la máquina del servidor<\/a> de la víctima. Se activa la víctima para que envíe una consulta DNS<\/a> SRV sobre el dominio. El servidor DNS del atacante responde con el nombre de host de la máquina del atacante y el puerto LDAP. La víctima envía una solicitud NBNS<\/strong> de difusión para encontrar la dirección IP<\/a> del nombre de host recibido (del atacante). El atacante envía una respuesta NBNS con su dirección IP. La víctima se convierte en un cliente LDAP y envía una solicitud CLDAP<\/strong> a la máquina del atacante. El atacante envía un paquete de respuesta de referencia CLDAP con un valor específico que hace que LSASS se bloquee y fuerce el reinicio del servidor de la víctima.<\/p>

Se podria conseguir un RCE<\/strong> (Remote Code Execution), modificando el ultimo paquete CLDAP.<\/p>

Recursos afectados<\/h2>

Servidor Windows<\/strong> sin parchear (no solo los controladores de dominio), excepto que el servidor<\/a> DNS del controlador de dominio víctima tenga conectividad a Internet.<\/p>

Solución<\/h2>

Aplicar el parche publicado por Microsoft en https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2024-49113<\/a>.<\/p>

Configura firewalls y reglas para bloquear tráfico DCE\/RPC, NBNS y CLDAP desde fuentes no confiables.<\/p>

Utiliza herramientas SIEM para detectar patrones de ataque en los protocolos mencionados.<\/p>

Fuente:<\/strong> NIST<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Vulnerabilidad crítica en el protocolo<\/a> LDAP de Windows que según Microsoft permite DoS y la ejecución remota de código.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[4],"tags":[44,203,147],"class_list":["post-11814","post","type-post","status-publish","format-standard","hentry","category-alertas-de-seguridad","tag-ciberseguridad","tag-rce","tag-vulnerabilidad","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-25"],"acf":[],"yoast_head":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows - INFORDISA \/ Security Operations Center<\/title>\n<meta name=\"description\" content=\"Vulnerabilidad cr\u00edtica en el protocolo LDAP de Windows que permite DoS y la ejecuci\u00f3n remota de c\u00f3digo.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows - INFORDISA \/ Security Operations Center\" \/>\n<meta property=\"og:description\" content=\"Vulnerabilidad cr\u00edtica en el protocolo LDAP de Windows que permite DoS y la ejecuci\u00f3n remota de c\u00f3digo.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/\" \/>\n<meta property=\"og:site_name\" content=\"INFORDISA \/ Security Operations Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infordisa\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-01-03T10:11:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-18T11:15:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2022\/02\/soc-infordisa-2022.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Jordi Sala\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infordisa\" \/>\n<meta name=\"twitter:site\" content=\"@infordisa\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jordi Sala\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/\"},\"author\":{\"name\":\"Jordi Sala\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/person\\\/9e7088b9a88f62117d466d94479b2375\"},\"headline\":\"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows\",\"datePublished\":\"2025-01-03T10:11:35+00:00\",\"dateModified\":\"2025-08-18T11:15:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/\"},\"wordCount\":304,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#organization\"},\"keywords\":[\"Ciberseguridad\",\"RCE\",\"Vulnerabilidad\"],\"articleSection\":[\"Alertas de seguridad\"],\"inLanguage\":\"es\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/\",\"name\":\"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows - INFORDISA \\\/ Security Operations Center\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#website\"},\"datePublished\":\"2025-01-03T10:11:35+00:00\",\"dateModified\":\"2025-08-18T11:15:39+00:00\",\"description\":\"Vulnerabilidad cr\u00edtica en el protocolo LDAP de Windows que permite DoS y la ejecuci\u00f3n remota de c\u00f3digo.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/vulnerabilidad-critica-ldap-en-servidores-windows\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#website\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\",\"name\":\"INFORDISA \\\/ Security Operations Center\",\"description\":\"Portal de Ciberseguridad\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#organization\",\"name\":\"INFORDISA \\\/ Security Operations Center\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/logo-securityoperationscenter.png\",\"contentUrl\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/logo-securityoperationscenter.png\",\"width\":400,\"height\":34,\"caption\":\"INFORDISA \\\/ Security Operations Center\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/infordisa\\\/\",\"https:\\\/\\\/x.com\\\/infordisa\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/infordisa\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/InfordisaTV\",\"https:\\\/\\\/www.instagram.com\\\/infordisa\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/#\\\/schema\\\/person\\\/9e7088b9a88f62117d466d94479b2375\",\"name\":\"Jordi Sala\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g\",\"caption\":\"Jordi Sala\"},\"description\":\"Marketing\",\"sameAs\":[\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/\"],\"url\":\"https:\\\/\\\/www.infordisa.com\\\/soc\\\/author\\\/jsala\\\/\"}]}<\/script>","yoast_head_json":{"title":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows - INFORDISA \/ Security Operations Center","description":"Vulnerabilidad cr\u00edtica en el protocolo LDAP de Windows que permite DoS y la ejecuci\u00f3n remota de c\u00f3digo.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/","og_locale":"es_ES","og_type":"article","og_title":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows - INFORDISA \/ Security Operations Center","og_description":"Vulnerabilidad cr\u00edtica en el protocolo LDAP de Windows que permite DoS y la ejecuci\u00f3n remota de c\u00f3digo.","og_url":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/","og_site_name":"INFORDISA \/ Security Operations Center","article_publisher":"https:\/\/www.facebook.com\/infordisa\/","article_published_time":"2025-01-03T10:11:35+00:00","article_modified_time":"2025-08-18T11:15:39+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2022\/02\/soc-infordisa-2022.png","type":"image\/png"}],"author":"Jordi Sala","twitter_card":"summary_large_image","twitter_creator":"@infordisa","twitter_site":"@infordisa","twitter_misc":{"Escrito por":"Jordi Sala","Tiempo de lectura":"2 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/#article","isPartOf":{"@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/"},"author":{"name":"Jordi Sala","@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/person\/9e7088b9a88f62117d466d94479b2375"},"headline":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows","datePublished":"2025-01-03T10:11:35+00:00","dateModified":"2025-08-18T11:15:39+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/"},"wordCount":304,"publisher":{"@id":"https:\/\/www.infordisa.com\/soc\/#organization"},"keywords":["Ciberseguridad","RCE","Vulnerabilidad"],"articleSection":["Alertas de seguridad"],"inLanguage":"es"},{"@type":"WebPage","@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/","url":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/","name":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows - INFORDISA \/ Security Operations Center","isPartOf":{"@id":"https:\/\/www.infordisa.com\/soc\/#website"},"datePublished":"2025-01-03T10:11:35+00:00","dateModified":"2025-08-18T11:15:39+00:00","description":"Vulnerabilidad cr\u00edtica en el protocolo LDAP de Windows que permite DoS y la ejecuci\u00f3n remota de c\u00f3digo.","breadcrumb":{"@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.infordisa.com\/soc\/vulnerabilidad-critica-ldap-en-servidores-windows\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/www.infordisa.com\/soc\/"},{"@type":"ListItem","position":2,"name":"Vulnerabilidad cr\u00edtica protocolo LDAP en servidores Windows"}]},{"@type":"WebSite","@id":"https:\/\/www.infordisa.com\/soc\/#website","url":"https:\/\/www.infordisa.com\/soc\/","name":"INFORDISA \/ Security Operations Center","description":"Portal de Ciberseguridad","publisher":{"@id":"https:\/\/www.infordisa.com\/soc\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infordisa.com\/soc\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/www.infordisa.com\/soc\/#organization","name":"INFORDISA \/ Security Operations Center","url":"https:\/\/www.infordisa.com\/soc\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/logo\/image\/","url":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2021\/11\/logo-securityoperationscenter.png","contentUrl":"https:\/\/www.infordisa.com\/soc\/wp-content\/uploads\/2021\/11\/logo-securityoperationscenter.png","width":400,"height":34,"caption":"INFORDISA \/ Security Operations Center"},"image":{"@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infordisa\/","https:\/\/x.com\/infordisa","https:\/\/www.linkedin.com\/company\/infordisa","https:\/\/www.youtube.com\/user\/InfordisaTV","https:\/\/www.instagram.com\/infordisa\/"]},{"@type":"Person","@id":"https:\/\/www.infordisa.com\/soc\/#\/schema\/person\/9e7088b9a88f62117d466d94479b2375","name":"Jordi Sala","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8c54ab66e828adf2561016ace1f387fbc25b3e9bb35a24b65c0d3cb64e309c28?s=96&r=g","caption":"Jordi Sala"},"description":"Marketing","sameAs":["https:\/\/www.infordisa.com\/soc\/"],"url":"https:\/\/www.infordisa.com\/soc\/author\/jsala\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/posts\/11814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/comments?post=11814"}],"version-history":[{"count":5,"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/posts\/11814\/revisions"}],"predecessor-version":[{"id":11838,"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/posts\/11814\/revisions\/11838"}],"wp:attachment":[{"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/media?parent=11814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/categories?post=11814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infordisa.com\/soc\/wp-json\/wp\/v2\/tags?post=11814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}