Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2020-17049

Kerberos KDC Security Feature Bypass Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
microsoft

Description

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Microsoft Windows Server 2019

  • 10.0.0 to < 10.0.17763.2061affected

Microsoft Windows Server 2019 (Server Core installation)

  • 10.0.0 to < 10.0.17763.2061affected

Microsoft Windows Server, version 1909 (Server Core installation)

  • 10.0.0 to < publicationaffected

Microsoft Windows Server, version 1903 (Server Core installation)

  • 10.0.0 to < publicationaffected

Microsoft Windows Server version 2004

  • 10.0.0 to < 10.0.19041.1110affected

Microsoft Windows Server 2016

  • 10.0.0 to < 10.0.14393.4530affected

Microsoft Windows Server 2016 (Server Core installation)

  • 10.0.0 to < 10.0.14393.4530affected

Microsoft Windows Server 2008 Service Pack 2

  • 6.0.0 to < 6.0.6003.21167affected

Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)

  • 6.0.0 to < 6.0.6003.21167affected

Microsoft Windows Server 2008 Service Pack 2

  • 6.0.0 to < 6.0.6003.21167affected

Microsoft Windows Server 2008 R2 Service Pack 1

  • 6.1.0 to < 6.1.7601.25661affected

Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)

  • 6.0.0 to < 6.1.7601.25661affected

Microsoft Windows Server 2012

  • 6.2.0 to < 6.2.9200.23409affected

Microsoft Windows Server 2012 (Server Core installation)

  • 6.2.0 to < 6.2.9200.23409affected

Microsoft Windows Server 2012 R2

  • 6.3.0 to < 6.3.9600.20069affected

Microsoft Windows Server 2012 R2 (Server Core installation)

  • 6.3.0 to < 6.3.9600.20069affected

Microsoft Windows Server version 20H2

  • 10.0.0 to < 10.0.19041.1110affected

References