=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN271
_____________________________________________________________________

DATE                : 19/11/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows running Microsoft Windows Kerberos KDC.

======================================================================
KB3011780
https://technet.microsoft.com/en-us/library/security/MS14-068
______________________________________________________________________

Microsoft Security Bulletin MS14-068 - Critical Vulnerability in
Kerberos Could Allow Elevation of Privilege (3011780)

Published: November 18, 2014

Version: 1.0

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows Kerberos KDC that could allow an attacker to elevate
unprivileged domain user account privileges to those of the domain
administrator account.
An attacker could use these elevated privileges to compromise any
computer in the domain, including domain controllers. An attacker must
have valid domain credentials to exploit this vulnerability. The
affected component is available remotely to users who have standard
user accounts with domain credentials; this is not the case for users
with local account credentials only. When this security bulletin was
issued, Microsoft was aware of limited, targeted attacks that attempt
to exploit this vulnerability.

This security update is rated Critical for all supported editions of
Windows Server 2003, Windows Server 2008, Windows Server 2008 R2,
Windows Server 2012, and Windows Server 2012 R2. The update is also
being provided on a defense-in-depth basis for all supported editions
of Windows Vista, Windows 7, Windows 8, and Windows 8.1. For more
information, see the Affected Software section.

The security update addresses the vulnerability by correcting signature
verification behavior in Windows implementations of Kerberos.


Affected Software

Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 8 and Windows 8.1
Windows Server 2012 and Windows Server 2012 R2

Vulnerability Information

Kerberos Checksum Vulnerability - CVE-2014-6324

A remote elevation of privilege vulnerability exists in implementations
of Kerberos KDC in Microsoft Windows. The vulnerability exists when the
Microsoft Kerberos KDC implementations fail to properly validate
signatures, which can allow for certain aspects of a Kerberos service
ticket to be forged. Microsoft received information about this
vulnerability through coordinated vulnerability disclosure. When this
security bulletin was issued, Microsoft was aware of limited, targeted
attacks that attempt to exploit this vulnerability. Note that the known
attacks did not affect systems running Windows Server 2012 or Windows
Server 2012 R2. The update addresses the vulnerability by correcting
signature verification behavior in Windows implementations of Kerberos.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================