CVE-2020-17049

EUVD-2020-9005

11.11.2020, 07:15

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).
To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.
The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.6 MEDIUM	NETWORK	HIGH	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
microsoft	CNA	6.6 MEDIUM				CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 96%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_server_2012	*
microsoft	windows_server_2016	-
microsoft	windows_server_2019	-
samba	samba	4.1.0 ≤ 𝑥 < 4.13.13
samba	samba	4.14.0 ≤ 𝑥 < 4.14.9
samba	samba	4.15.0 ≤ 𝑥 < 4.15.1

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows Server

1903 Server Core	KB4592449
1909 Server Core	KB5001337
2004 Server Core	KB5004237
20H2 Server Core	KB5004237

Windows Server 2008

Service Pack 2 (x64, x86)	KB5004305
Service Pack 2 Server Core (x64, x86)	KB5004305

Windows Server 2008 R2

Service Pack 1 (x64)	KB5004307
Service Pack 1 Server Core (x64)	KB5004307

Windows Server 2012

Server Core	KB5004302
Standard	KB5004302

Windows Server 2012 R2

Server Core	KB5004298
Standard	KB5004298

Windows Server 2016

Server Core	KB5004238
Standard	KB5004238

Windows Server 2019

Server Core	KB5004244
Standard	KB5004244

Common Weakness Enumeration

CWE-863 - Incorrect Authorization
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References

http://www.openwall.com/lists/oss-security/2021/11/10/3

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17049

https://security.gentoo.org/glsa/202309-06

http://www.openwall.com/lists/oss-security/2021/11/10/3

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17049

https://security.gentoo.org/glsa/202309-06