NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2014-6324

Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."

Affected products

VendorProductAffected versions
MicrosoftWindows 7
All versions
MicrosoftWindows 8
All versions
MicrosoftWindows 8.1
All versions
MicrosoftWindows Server 2003
All versions
MicrosoftWindows Server 2008
All versions
Version r2
MicrosoftWindows Server 2012
All versions
Version r2

References