Technical Information

Brief overview of the risk:
This security update resolves a vulnerability in Active Directory Federation Services (AD FS). The vulnerability could allow information disclosure if a user leaves their browser open after logging off from an application and an attacker reopens the application in the browser immediately after the user has logged off.

Detailed Information on the risk:

An information disclosure vulnerability exists when Active Directory Federation Services (AD FS) fails to properly log off a user. The vulnerability could allow unintentional information disclosure. An attacker who successfully exploited this vulnerability could gain access to a user’s information by reopening an application from which the user has logged off. Since the logoff actually fails an attacker is not prompted to enter a username or password. An attacker could then use this vulnerability to discover information to which an AD FS user has access.

Further information on this exploit is available at : MS15-040

Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)