Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //


04:20 PM
Connect Directly

Microsoft Issues Emergency Patch Amid Targeted Attacks

Windows Kerberos authentication bug "critical."

A newly discovered and critical security flaw in the Windows implementation of the Kerberos authentication scheme is being used in targeted attacks, prompting Microsoft to release an out-of-band patch today, one week after its regular Patch Tuesday cycle.

Microsoft is urging the immediate patching of domain controllers for this new Windows Kerberos elevation of privilege vulnerability, MS14-068, which has been seen being abused in "limited, targeted attacks," according to the software giant. The bug could allow an attacker to elevate an unprivileged domain user account to a domain administrator account, and ultimately take control of domain controllers or other servers in the server domain. The bug in the Kerberos Key Distribution Center affects Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.

"The main risk of this vulnerability is that an attacker who breached a particular system in an organization could use this vulnerability to move, not only laterally between systems using credentials pilfered from the initial compromise, but... also escalate privileges and gain access of remote systems as an administrator," says Johannes Ullrich, director of SANS Internet Storm Center.

Microsoft doesn’t usually rate privilege escalation as "critical" -- nor does SANS -- he says, but because this flaw attacks the Kerberos authentication system used in organizations, it's more serious. Ullrich says privilege escalation rarely gets the critical rating because the step of escalating user privilege alone doesn't lead to a compromise.

"Privilege escalation itself doesn't lead to compromise. It requires another -- typically 'critical' -- vulnerability first," he says. "For example, an arbitrary code execution vulnerability, which is usually rated critical."

Despite Microsoft's recommendations of escalated patching, Ullrich says, given the high volume of security patches from Microsoft this month as well as problems with some of them, it's probably best to test it first and wait a week before deploying it. "I consider this bug critical," he says, but doesn't need to be patched in a rush.

The attacker basically exploits the bug by sending a forged Kerberos ticket to the Kerberos Key Distribution Center (KDC), and the KDC then validates it and the attacker can do harm. Once the attacker gets domain admin credentials, he or she can install programs, alter or delete data, and create new accounts, for example.

"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed," Joe Bialek of MSRC Engineering said in a post today on the technical details of the flaw. "Therefore it is critical to install the update immediately."

A patch is also available for Windows Vista, Windows 7, Windows 8, and 8.1 machines, in what Microsoft calls "a defense-in-depth" approach, because they aren't vulnerable to the flaw, but they could ultimately be in harm's way in such an attack.

"The exploit found in-the-wild targeted a vulnerable code path in domain controllers running on Windows Server 2008R2 and below. Microsoft has determined that domain controllers running 2012 and above are vulnerable to a related attack, but it would be significantly more difficult to exploit," said Bialek. "Non-domain controllers running all versions of Windows are receiving a 'defense in depth' update but are not vulnerable to this issue."

[No patches released for the now-unsupported XP even though the 19-year-old OLE bug is critical and the "Winshock" bug in Windows' SSL/TLS installation could be worse than Heartbleed. Read Microsoft Fixes Critical SChannel & OLE Bugs, But No Patches For XP.]

Meanwhile, Microsoft also issued an update to the problematic MS14-066 SChannel patch that it first released last week.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
11/19/2014 | 4:24:20 PM
Re: There's still life in this
@Eamon_Walsh1,... if I understand you, I would advise you or anyone else trying to use those patches designed for Windows XP POS\Embedded systems not to risk using them in production... nothing lasts forever, it's (past) time to let it go. IMO, these are the decisions management make, thus bringing security down in an organization, because all it takes is one voice to make this case for using those patches in production "but...we can get by for 5 more years..." when the reality is you probably should have began the move from XP 5 years ago. So, what is your POV on Windows 2003 Server, you know it sundowns 7/14/2015... think you can tough it out for 5 more years?

Please do not take this as an attack against you, but this is a battle that was very hard to convience anyone that MS would actually sundown XP, and now we're coming up on 2003 Server... not to mention unsupported DB and other apps, and this is just not Microsoft. So now (yeah, now) we're developing a software lifecycle to address these problems, but first we have to prove we can follow our own rules.
User Rank: Apprentice
11/18/2014 | 5:09:04 PM
There's still life in this
Between all the hollering for OS upgrades, not only has it emerged that using POS you can effectively bypass the entire XP sunset for almost 5 more years of sun, but critical vulnerabilities to this plan. Cue, madcap patching and nice-sounding but really 'damage control' work. Let's hope there's less to it that anticipated. Meanwhile, unofficial XP SP4 patches come about too ..  bit.ly/10x8en6
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-20
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
PUBLISHED: 2020-10-20
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
PUBLISHED: 2020-10-20
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.
PUBLISHED: 2020-10-20
The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information.
PUBLISHED: 2020-10-20
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw...