Microsoft has just released an “out-of-band” security updates to patch a critical vulnerability in all supported versions of its Windows Server software, the flaw resides in Kerberos (Kerberos Checksum Vulnerability – CVE-2014-6324) and could allow elevation of Privilege according the Microsoft Security Bulletin MS14-068.
According to Microsoft the update fixes a vulnerability privately reported to the company that affect Microsoft Windows Kerberos KDC that could be exploited by an attacker to to elevate unprivileged domain user account privileges to those of the domain administrator account. This means that the attacker with valid domain credentials could compromise any computer in the domain.
An attacker can take control of any domain accounts, create new accounts, change group membership, install programs, view\modify\delete data, they wish. Every computer in the network is at risk, including the domain controllers.
Microsoft has also confirmed that cyber criminals are already exploiting the vulnerability in Microsoft Windows Kerberos KDC to compromise networks of computers worldwide.
“This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to exploit this vulnerability. The affected component is available remotely to users who have standard user accounts with domain credentials; this is not the case for users with local account credentials only. When this security bulletin was issued, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability.” states the Microsoft Security Bulletin MS14-068.
The vulnerability critically affects all supported editions of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2, a detailed list of affected OS is available in the “Affected Software section” of the bulletin.The update is anyway extended to other OS of the IT giant including all supported editions of Windows Vista, Windows 7, Windows 8, and Windows 8.1.
“The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit. Non-domain controllers running all versions of Windows are receiving a “defense in depth” update but are not vulnerable to this issue,” Microsoft’s SWIAT team said in a blog post.
Microsoft has addressed the vulnerability by correcting signature verification behavior in Windows implementations of the computer network authentication protocol Kerberos.As explained by Microsoft that rated the vulnerability as “critical”, the Kerberos Checksum Vulnerability poses a severe threat to organisations.
What systems are primarily at risk from the vulnerability?
Domain controllers that are configured to act as a Kerberos Key Distribution Center (KDC) are primarily at risk.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.