“This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to exploit this vulnerability. The affected component is available remotely to users who have standard user accounts with domain credentials; this is not the case for users with local account credentials only. When this security bulletin was issued, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability.” states the Microsoft Security Bulletin MS14-068.

The vulnerability critically affects all supported editions of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2, a detailed list of affected OS is available in the “Affected Software section” of the bulletin.The update is anyway extended to other OS of the IT giant including all supported editions of Windows Vista, Windows 7, Windows 8, and Windows 8.1.

“The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit. Non-domain controllers running all versions of Windows are receiving a “defense in depth” update but are not vulnerable to this issue,” Microsoft’s SWIAT team said in a blog post.

Microsoft has addressed the vulnerability by correcting signature verification behavior in Windows implementations of  the computer network authentication protocol Kerberos.As explained by Microsoft that rated the vulnerability as “critical”, the Kerberos Checksum Vulnerability poses a severe threat to organisations.

What systems are primarily at risk from the vulnerability? 
Domain controllers that are configured to act as a Kerberos Key Distribution Center (KDC) are primarily at risk.