Microsoft Issues Emergency Patch Amid Targeted Attacks

Windows Kerberos authentication bug critical.

A newly discovered and critical security flaw in the Windows implementation of the Kerberos authentication scheme is being used in targeted attacks, prompting Microsoft to release an out-of-band patch today, one week after its regular Patch Tuesday cycle.
Microsoft is urging the immediate patching of domain controllers for this new Windows Kerberos elevation of privilege vulnerability,
MS14-068
, which has been seen being abused in limited, targeted attacks, according to the software giant. The bug could allow an attacker to elevate an unprivileged domain user account to a domain administrator account, and ultimately take control of domain controllers or other servers in the server domain. The bug in the Kerberos Key Distribution Center affects Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.
The main risk of this vulnerability is that an attacker who breached a particular system in an organization could use this vulnerability to move, not only laterally between systems using credentials pilfered from the initial compromise, but... also escalate privileges and gain access of remote systems as an administrator, says Johannes Ullrich, director of SANS Internet Storm Center.
Microsoft doesn’t usually rate privilege escalation as critical -- nor does SANS -- he says, but because this flaw attacks the Kerberos authentication system used in organizations, its more serious. Ullrich says privilege escalation rarely gets the critical rating because the step of escalating user privilege alone doesnt lead to a compromise.
Privilege escalation itself doesnt lead to compromise. It requires another -- typically critical -- vulnerability first, he says. For example, an arbitrary code execution vulnerability, which is usually rated critical.
Despite Microsofts recommendations of escalated patching, Ullrich says, given the high volume of security patches from Microsoft this month as well as problems with some of them, its probably best to test it first and wait a week before deploying it. I consider this bug critical, he says, but doesnt need to be patched in a rush.
The attacker basically exploits the bug by sending a forged Kerberos ticket to the Kerberos Key Distribution Center (KDC), and the KDC then validates it and the attacker can do harm. Once the attacker gets domain admin credentials, he or she can install programs, alter or delete data, and create new accounts, for example.
The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed, Joe Bialek of MSRC Engineering said in
a post today
on the technical details of the flaw. Therefore it is critical to install the update immediately.
A patch is also available for Windows Vista, Windows 7, Windows 8, and 8.1 machines, in what Microsoft calls a defense-in-depth approach, because they arent vulnerable to the flaw, but they could ultimately be in harms way in such an attack.
The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit, said Bialek. Non-domain controllers running all versions of Windows are receiving a defense in depth update but are not vulnerable to this issue.
[No patches released for the now-unsupported XP even though the 19-year-old OLE bug is critical and the Winshock bug in Windows SSL/TLS installation could be worse than Heartbleed. Read
Microsoft Fixes Critical SChannel & OLE Bugs, But No Patches For XP
.]
Meanwhile, Microsoft also issued an
update to the problematic MS14-066 SChannel patch
that it first released last week.

Last News
▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security	▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Issues Emergency Patch Amid Targeted Attacks