Pierluigi Paganini
November 19, 2014
Microsoft has just released an “out-of-band” security updates to patch a critical vulnerability in all supported versions of its Windows Server software, the flaw resides in Kerberos (Kerberos Checksum Vulnerability – CVE-2014-6324) and could allow elevation of Privilege according the Microsoft Security Bulletin MS14-068.
According to Microsoft the update fixes a vulnerability privately reported to the company that affect Microsoft Windows Kerberos KDC that could be exploited by an attacker to to elevate unprivileged domain user account privileges to those of the domain administrator account. This means that the attacker with valid domain credentials could compromise any computer in the domain.
An attacker can take control of any domain accounts, create new accounts, change group membership, install programs, view\modify\delete data, they wish. Every computer in the network is at risk, including the domain controllers.
Microsoft has also confirmed that cyber criminals are already exploiting the vulnerability in Microsoft Windows Kerberos KDC to compromise networks of computers worldwide.
“This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to exploit this vulnerability. The affected component is available remotely to users who have standard user accounts with domain credentials; this is not the case for users with local account credentials only. When this security bulletin was issued, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability.” states the Microsoft Security Bulletin MS14-068.
The vulnerability critically affects all supported editions of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2, a detailed list of affected OS is available in the “Affected Software section” of the bulletin.The update is anyway extended to other OS of the IT giant including all supported editions of Windows Vista, Windows 7, Windows 8, and Windows 8.1.
“The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit. Non-domain controllers running all versions of Windows are receiving a “defense in depth” update but are not vulnerable to this issue,” Microsoft’s SWIAT team said in a blog post.
Microsoft has addressed the vulnerability by correcting signature verification behavior in Windows implementations of the computer network authentication protocol Kerberos.As explained by Microsoft that rated the vulnerability as “critical”, the Kerberos Checksum Vulnerability poses a severe threat to organisations.
What systems are primarily at risk from the vulnerability?
Domain controllers that are configured to act as a Kerberos Key Distribution Center (KDC) are primarily at risk.
(Security Affairs – Microsoft, Kerberos Checksum Vulnerability – CVE-2014-6324)
