![\"NCCIC](\"https:\/\/public.govdelivery.com\/system\/images\/37745\/original\/BANNER_NCCIC_USC_01.png\")
<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nSystems Affected<\/h3>\n\n\n\n\n- Microsoft Windows Vista, 7, 8, and 8.1<\/li>\n
- Microsoft Server 2003, Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n
Overview<\/h3>\n\n\n\nA remote escalation of privilege vulnerability exists in implementations of Kerberos Key Distribution Center (KDC) in Microsoft Windows which could allow a remote attacker to take control of a vulnerable system. [1(link is external)<\/span><\/span><\/a>]<\/p>\n<\/div>\n<\/div>\n<\/div>\nDescription<\/h3>\n\n\n\nThe Microsoft Windows Kerberos KDC fails to properly check service tickets for valid signatures, which can allow aspects of the service ticket to be forged. The improper check allows an attacker to escalate valid domain user account privileges to those of a domain administrator account, which renders the entire domain vulnerable to compromise.<\/p>\n
At the time this release was issued, Microsoft was aware of limited, targeted attacks attempting to exploit this vulnerability.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
Impact<\/h3>\n\n\n\nA valid domain user can pass invalid domain administrator credentials, gain access and compromise any system on the domain, including the domain controller. [2<\/a>]<\/p>\n<\/div>\n<\/div>\n<\/div>\nSolution<\/h3>\n\n\n\nAn update is available from Microsoft. Please see Microsoft Security Bulletin MS14-068 and Microsoft Research Security and Defense Blog for more details, and apply the necessary updates.[1(link is external)<\/span><\/span><\/a>, 3(link is external)<\/span><\/span><\/a>]<\/p>\n<\/div>\n<\/div>\n<\/div>\nReferences<\/h3>\n\n\n- Microsoft Security Bulletin MS14-068 (link is external)<\/span><\/span><\/a><\/li>\n
- Vulnerability Note VU#213119<\/a><\/li>\n
- Microsoft Security Research and Defense Blog(link is external)<\/span><\/span><\/a><\/li>\n<\/ul>\n<\/div>\n
Revisions<\/h3>\n\n\n- November 19, 2014: Initial Draft<\/li>\n<\/ul>\n<\/div>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Latest alert from Systems Affected Microsoft Windows Vista, 7, 8, and 8.1 Microsoft Server 2003, Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2 Overview A remote escalation of privilege vulnerability exists in implementations of Kerberos Key … Continue reading
- \n
- Microsoft Windows Vista, 7, 8, and 8.1<\/li>\n
- Microsoft Server 2003, Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n
Overview<\/h3>\n
\n\n\nA remote escalation of privilege vulnerability exists in implementations of Kerberos Key Distribution Center (KDC) in Microsoft Windows which could allow a remote attacker to take control of a vulnerable system. [1(link is external)<\/span><\/span><\/a>]<\/p>\n<\/div>\n<\/div>\n<\/div>\n
Description<\/h3>\n
\n\n\nThe Microsoft Windows Kerberos KDC fails to properly check service tickets for valid signatures, which can allow aspects of the service ticket to be forged. The improper check allows an attacker to escalate valid domain user account privileges to those of a domain administrator account, which renders the entire domain vulnerable to compromise.<\/p>\n
At the time this release was issued, Microsoft was aware of limited, targeted attacks attempting to exploit this vulnerability.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
Impact<\/h3>\n
\n\n\nA valid domain user can pass invalid domain administrator credentials, gain access and compromise any system on the domain, including the domain controller. [2<\/a>]<\/p>\n<\/div>\n<\/div>\n<\/div>\n
Solution<\/h3>\n
\n\n\nAn update is available from Microsoft. Please see Microsoft Security Bulletin MS14-068 and Microsoft Research Security and Defense Blog for more details, and apply the necessary updates.[1(link is external)<\/span><\/span><\/a>, 3(link is external)<\/span><\/span><\/a>]<\/p>\n<\/div>\n<\/div>\n<\/div>\n
References<\/h3>\n
\n- \n
- Microsoft Security Bulletin MS14-068 (link is external)<\/span><\/span><\/a><\/li>\n
- Vulnerability Note VU#213119<\/a><\/li>\n
- Microsoft Security Research and Defense Blog(link is external)<\/span><\/span><\/a><\/li>\n<\/ul>\n<\/div>\n
Revisions<\/h3>\n
\n- \n
- November 19, 2014: Initial Draft<\/li>\n<\/ul>\n<\/div>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Latest alert from Systems Affected Microsoft Windows Vista, 7, 8, and 8.1 Microsoft Server 2003, Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2 Overview A remote escalation of privilege vulnerability exists in implementations of Kerberos Key … Continue reading
- Vulnerability Note VU#213119<\/a><\/li>\n
- Microsoft Security Bulletin MS14-068 (link is external)<\/span><\/span><\/a><\/li>\n