Patched Windows Vulnerability Allows For Remote Privilege Escalation

Microsoft has released an out-of-band security bulletin (MS14-068) that addresses a vulnerability in the implementation of Kerberos in various versions of Windows. The bulletin states that this vulnerability is already being used in “limited, targeted attacks”. This warning, plus the fact that Microsoft considered this threat serious enough to merit an out-of-cycle patch, should make users consider patching as soon as possible.

Kerberos is a protocol used to authenticate users within a network. This vulnerability (designated as CVE-2014-6324) could allow an attacker to escalate privileges to that of a domain administrator; this could then be used to compromise any system connected to that domain, including domain servers.

This is a serious flaw which lends itself to usage in targeted attacks. An attacker will have to use separate means to penetrate a network, but once inside this vulnerability could be used to compromise any machine connected to the organization’s domain server (effectively, all machines).

Used properly, this vulnerability is as effective a tool for moving laterally within an organization as is known today. No workaround or mitigation has been clearly identified by Microsoft (aside from patching the vulnerability); the only requirement for a successful attack is for the attacker to already have valid domain credentials. For an attacker that has already penetrated existing networks, this hardly represents a barrier.

The damage an attacker could do if an organization’s domain server was compromised could be significant. In a worst case scenario, the entire domain would have to be rebuilt from the ground up, which would be extremely costly in time and resources for any organization.

Microsoft itself suggests that this attack has been used in targeted attacks saying that they “are aware of limited, targeted attacks that attempt to exploit this vulnerability.” With knowledge that a vulnerability exists, and information provided by the patch, we can expect to see more attacks that target this flaw in the future.

The vulnerability is present in all server versions of Windows from Server 2003 onward. Administrators should immediately roll out patches to these systems as soon as is practical. A patch is available for client versions of Windows, but this is a defense-in-depth upgrade that does not address any vulnerabilities.

Post from: Trendlabs Security Intelligence Blog – by Trend Micro

Patched Windows Vulnerability Allows For Remote Privilege Escalation