CVE-2014-6324
critical-risk
Published 2014-11-18
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
Do I need to act?
!
89.9% chance of exploitation in next 30 days
EPSS score — higher than 10% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (9)
Affected Vendors
References (15)
Mailing List
http://marc.info/?l=bugtraq&m=142350249315918&w=2
Broken Link
http://secunia.com/advisories/62556
Broken Link
http://www.securityfocus.com/bid/70958
Broken Link
http://www.securitytracker.com/id/1031237
Third Party Advisory
http://www.us-cert.gov/ncas/alerts/TA14-323A
Mailing List
http://marc.info/?l=bugtraq&m=142350249315918&w=2
Broken Link
http://secunia.com/advisories/62556
Broken Link
http://www.securityfocus.com/bid/70958
Broken Link
http://www.securitytracker.com/id/1031237
Third Party Advisory
http://www.us-cert.gov/ncas/alerts/TA14-323A
79
/ 100
critical-risk
Severity
30/34 · Critical
Exploitability
34/34 · Critical
Exposure
15/34 · Moderate