CVE-2014-6324
Published: 18 November 2014
Summary
CVE-2014-6324 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
The vulnerability is an improper checksum validation flaw in the Kerberos Key Distribution Center (KDC) that permits a forged signature within a Kerberos ticket. It affects the KDC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2, and carries a CVSS 3.1 score of 8.8.
Remote authenticated domain users can exploit the weakness to obtain domain administrator privileges. The issue was observed being exploited in the wild in November 2014.
Public references, including the Microsoft Security Research & Defense blog post, Secunia advisory 62556, SecurityFocus BID 70958, and SecurityTracker 1031237, provide additional technical details and link to the corresponding security updates released by Microsoft.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2014-6208
Vulnerability details
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain…
more
users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access decisions; the CVE is a bypass of Kerberos ticket validation that grants unauthorized domain-admin privileges.
Requires secure identification and authentication of organizational users; the flaw allows forged Kerberos tickets to subvert domain authentication.
Protects the integrity of transmitted authentication material; the CVE exploits missing checksum validation on Kerberos tickets in transit/processing.