Vulnerability Description
A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows Server 2012 | All versions |
| Microsoft | Windows Server 2016 | - |
| Microsoft | Windows Server 2019 | - |
| Samba | Samba | >= 4.1.0, < 4.13.13 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2021/11/10/3Mailing ListThird Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1704PatchVendor Advisory
- https://security.gentoo.org/glsa/202309-06
- http://www.openwall.com/lists/oss-security/2021/11/10/3Mailing ListThird Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1704PatchVendor Advisory
- https://security.gentoo.org/glsa/202309-06
FAQ
What is CVE-2020-17049?
CVE-2020-17049 is a vulnerability with a CVSS score of 6.6 (MEDIUM). A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit ...
How severe is CVE-2020-17049?
CVE-2020-17049 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-17049?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Samba Samba.