Microsoft Issues Emergency Patch Amid Targeted Attacks

Windows Kerberos authentication bug "critical."

A newly discovered and critical security flaw in the Windows implementation of the Kerberos authentication scheme is being used in targeted attacks, prompting Microsoft to release an out-of-band patch today, one week after its regular Patch Tuesday cycle.

Microsoft is urging the immediate patching of domain controllers for this new Windows Kerberos elevation of privilege vulnerability, MS14-068, which has been seen being abused in "limited, targeted attacks," according to the software giant. The bug could allow an attacker to elevate an unprivileged domain user account to a domain administrator account, and ultimately take control of domain controllers or other servers in the server domain. The bug in the Kerberos Key Distribution Center affects Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.

"The main risk of this vulnerability is that an attacker who breached a particular system in an organization could use this vulnerability to move, not only laterally between systems using credentials pilfered from the initial compromise, but... also escalate privileges and gain access of remote systems as an administrator," says Johannes Ullrich, director of SANS Internet Storm Center.

Microsoft doesn’t usually rate privilege escalation as "critical" -- nor does SANS -- he says, but because this flaw attacks the Kerberos authentication system used in organizations, it's more serious. Ullrich says privilege escalation rarely gets the critical rating because the step of escalating user privilege alone doesn't lead to a compromise.

"Privilege escalation itself doesn't lead to compromise. It requires another -- typically 'critical' -- vulnerability first," he says. "For example, an arbitrary code execution vulnerability, which is usually rated critical."

Despite Microsoft's recommendations of escalated patching, Ullrich says, given the high volume of security patches from Microsoft this month as well as problems with some of them, it's probably best to test it first and wait a week before deploying it. "I consider this bug critical," he says, but doesn't need to be patched in a rush.

The attacker basically exploits the bug by sending a forged Kerberos ticket to the Kerberos Key Distribution Center (KDC), and the KDC then validates it and the attacker can do harm. Once the attacker gets domain admin credentials, he or she can install programs, alter or delete data, and create new accounts, for example.

"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed," Joe Bialek of MSRC Engineering said in a post today on the technical details of the flaw. "Therefore it is critical to install the update immediately."

A patch is also available for Windows Vista, Windows 7, Windows 8, and 8.1 machines, in what Microsoft calls "a defense-in-depth" approach, because they aren't vulnerable to the flaw, but they could ultimately be in harm's way in such an attack.

"The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit," said Bialek. "Non-domain controllers running all versions of Windows are receiving a 'defense in depth' update but are not vulnerable to this issue."

[No patches released for the now-unsupported XP even though the 19-year-old OLE bug is critical and the "Winshock" bug in Windows' SSL/TLS installation could be worse than Heartbleed. Read Microsoft Fixes Critical SChannel & OLE Bugs, But No Patches For XP.]

Meanwhile, Microsoft also issued an update to the problematic MS14-066 SChannel patch that it first released last week.

About the Author(s)

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights