CVE-2024-21410

Since there are at least 3 threads for this... 

If you are only using OWA - or ActiveSync - You can use form-based or basic-auth SSO with EAP and this will work. 

During a brainstorming we came up with a simple solution for protecting against NTLM relay attacks, when using SSO with APM, you simply either block or remove the authorization header on the clientside. All NTLM should only be present between APM and Exchange.

This will give you inside into who is compromised as you can log when you see any clientside NTLM headers. It will also stop any NTLM negotiation attempts from the client browser as that can be considered unwanted information disclosure. 

If you are not deploying APM SSO you could make a semi proteted solution by picking up the first NTLM hash you see from the client and store it in a table. If you encounter a different hash later in the session you know it is bad and can either block it or start alarming. It is not bulletproof, but it is better than nothing.

The word on the street is that EPA is expected to be supported in NEXT, late this year.

F5 does not support Extended Protection in SSL Bridging Mode. There is an RFE to support this, but it is rather unlikely that it is implemted for BIGIP Classic.

(Bug alias 758880) [RFE] [NTLM V2 SSO] Support MS IIS option "Extended protection" with value "required" during authentication

Hi THE_BLUE,

to my knowledge F5 does not provide an Attack Signature or a Threat Campaign that protects from CVE-2024-21410.

Extended Protection is supported in environments that use SSL Bridging under certain conditions. That should solve your issue.
IMHO the days of SSL offloading are anyhow over, also internal networks cannot be considered as secure any longer. Therefore, go for SSL Bridging.

KR
Daniel