CVE-2014-6324

CVSS 8.8 HIGHEPSS 87.4%● KEV

In short

A flaw in Windows Kerberos authentication allows someone already logged into a domain to forge tickets and trick the system into granting them administrator-level access. This is dangerous because it lets attackers escalate their privileges without needing additional credentials.

Technical detail

The KDC in affected Windows versions fails to properly validate checksum signatures in Kerberos tickets, allowing authenticated domain users to forge valid tickets with elevated privileges. An attacker with valid domain credentials can craft a malicious ticket to impersonate an administrator and gain domain-level access without further authentication.

Summary generated and translated by AI from the official description.

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/35474unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx http://marc.info/?l=bugtraq&m=142350249315918&w=2 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068 http://secunia.com/advisories/62556 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6324 http://www.securityfocus.com/bid/70958 http://www.securitytracker.com/id/1031237 http://www.us-cert.gov/ncas/alerts/TA14-323A