Categories: Security

Microsoft issued a critical Out-of-Band patch for Kerberos flaw

Microsoft on Tuesday released a rare out-of-band patch for a critical vulnerability in Kerberos that could allow elevation of privilege.

Microsoft has just released an “out-of-band” security updates to patch a critical vulnerability in all supported versions of its Windows Server software, the flaw resides in Kerberos (Kerberos Checksum Vulnerability – CVE-2014-6324) and could allow elevation of Privilege according the Microsoft Security Bulletin MS14-068.

According to Microsoft the update fixes a vulnerability privately reported to the company that affect Microsoft Windows Kerberos KDC that could be exploited by an attacker to to elevate unprivileged domain user account privileges to those of the domain administrator account. This means that the attacker with valid domain credentials could compromise any computer in the domain.

An attacker can take control of any domain accounts, create new accounts, change group membership, install programs, view\modify\delete data, they wish. Every computer in the network is at risk, including the domain controllers.

Microsoft has also confirmed that cyber criminals are already exploiting the vulnerability in Microsoft Windows Kerberos KDC to compromise networks of computers worldwide.

“This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to exploit this vulnerability. The affected component is available remotely to users who have standard user accounts with domain credentials; this is not the case for users with local account credentials only. When this security bulletin was issued, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability.” states the Microsoft Security Bulletin MS14-068.

The vulnerability critically affects all supported editions of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2, a detailed list of affected OS is available in the “Affected Software section” of the bulletin.The update is anyway extended to other OS of the IT giant including all supported editions of Windows Vista, Windows 7, Windows 8, and Windows 8.1.

“The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit. Non-domain controllers running all versions of Windows are receiving a “defense in depth” update but are not vulnerable to this issue,” Microsoft’s SWIAT team said in a blog post.

Microsoft has addressed the vulnerability by correcting signature verification behavior in Windows implementations of the computer network authentication protocol Kerberos.As explained by Microsoft that rated the vulnerability as “critical”, the Kerberos Checksum Vulnerability poses a severe threat to organisations.

What systems are primarily at risk from the vulnerability?
Domain controllers that are configured to act as a Kerberos Key Distribution Center (KDC) are primarily at risk.

Microsoft credited “the Qualcomm Information Security & Risk Management team” for reporting the vulnerability in Kerberos implementation, with special recognition for Qualcomm cyber security engineer Tom Maddock for his support. Microsoft has issued an emergency patch to fix the vulnerability in Microsoft Windows Kerberos KDC and urges its customers to install the fix as son as possible.

Pierluigi Paganini

(Security Affairs – Microsoft, Kerberos Checksum Vulnerability – CVE-2014-6324)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.