Microsoft Windows Terminal Service Kerberos Double Authorization Data Entry Vulnerability
BID:8102
Info
Microsoft Windows Terminal Service Kerberos Double Authorization Data Entry Vulnerability
| Bugtraq ID: | 8102 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 26 2003 12:00AM |
| Updated: | Jun 26 2003 12:00AM |
| Credit: | This vulnerability was announced by the vendor. |
| Vulnerable: |
Microsoft Windows 2000 Terminal Services SP3 Microsoft Windows 2000 Terminal Services SP2 Microsoft Windows 2000 Terminal Services SP1 Microsoft Windows 2000 Terminal Services |
| Not Vulnerable: |
Microsoft Windows 2000 Terminal Services SP4 |
Discussion
Microsoft Windows Terminal Service Kerberos Double Authorization Data Entry Vulnerability
It has been reported that Microsoft Windows does not properly handle kerberos ticketing under some circumstances. Because of this, an attacker may be able to create a kerberos ticket with two authorization data entries.
This issue was announced with the release of Microsoft Windows 2000 SP4.
BID 8045 was sent out to acknowledge the release of this service pack
and the announcement of a number of new vulnerabilities. Analysis of
these issues is completed and each of the issues is now being assigned
its own BID.
It has been reported that Microsoft Windows does not properly handle kerberos ticketing under some circumstances. Because of this, an attacker may be able to create a kerberos ticket with two authorization data entries.
This issue was announced with the release of Microsoft Windows 2000 SP4.
BID 8045 was sent out to acknowledge the release of this service pack
and the announcement of a number of new vulnerabilities. Analysis of
these issues is completed and each of the issues is now being assigned
its own BID.
Exploit / POC
Microsoft Windows Terminal Service Kerberos Double Authorization Data Entry Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Microsoft Windows Terminal Service Kerberos Double Authorization Data Entry Vulnerability
Solution:
Microsoft has made a service pack available to address this issue.
Microsoft Windows 2000 Terminal Services SP1
Microsoft Windows 2000 Terminal Services SP3
Microsoft Windows 2000 Terminal Services
Microsoft Windows 2000 Terminal Services SP2
Solution:
Microsoft has made a service pack available to address this issue.
Microsoft Windows 2000 Terminal Services SP1
-
Microsoft Windows 2000 SP4
http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/defaul t.asp
Microsoft Windows 2000 Terminal Services SP3
-
Microsoft Windows 2000 SP4
http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/defaul t.asp
Microsoft Windows 2000 Terminal Services
-
Microsoft Windows 2000 SP4
http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/defaul t.asp
Microsoft Windows 2000 Terminal Services SP2
-
Microsoft Windows 2000 SP4
http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/defaul t.asp
References
Microsoft Windows Terminal Service Kerberos Double Authorization Data Entry Vulnerability
References:
References:
- Windows 2000 Service Pack 4 (Microsoft)