Vulnerability Note VU#610133

Microsoft Windows domain controller denial of service in Kerberos message handling

Overview

Microsoft Windows domain controllers do not properly handle some Kerberos messages, potentially allowing a remote, authenticated attacker to cause a denial-of-service condition.

I. Description

Microsoft Windows domain controllers running Windows 2000 Server and Server 2003 use the Kerberos protocol for authentication by default. The Kerberos implementation in the affected products is vulnerable to a flaw in handling messages from remote authenticated users. This flaw may allow an attacker to cause the authentication system to stop responding or to forcefully reboot the domain controller.

Systems running the affected products that do not function as domain controllers are not affected. Windows 2000 Professional and Windows XP are not affected. The attacker must have valid logon credentials in order to exploit the vulnerability.

II. Impact

A remote authenticated user that is able to send a specially-crafted message may be able to cause the domain controller authentication service to stop responding, or to force the machine to reboot.

III. Solution

Apply An Update

Please see Microsoft Security Bulletin MS05-042 for information on fixes, updates, and workarounds.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	9-Aug-2005

References

http://www.microsoft.com/technet/security/bulletin/MS05-042.mspx

Credit

Thanks to Microsoft Security Advisory for information on this vulnerability, who in turn thank Tony Chin of Shell, Inc. for reporting the issue.

This document was written by Ken MacInnis.

Other Information

Date Public:	2005-08-09
Date First Published:	2005-08-10
Date Last Updated:	2005-08-10
CERT Advisory:
CVE-ID(s):	CAN-2005-1981
NVD-ID(s):	CAN-2005-1981
US-CERT Technical Alerts:
Metric:	10.94
Document Revision:	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader