search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Windows domain controller denial of service in Kerberos message handling

Vulnerability Note VU#610133

Original Release Date: 2005-08-10 | Last Revised: 2005-08-10


Microsoft Windows domain controllers do not properly handle some Kerberos messages, potentially allowing a remote, authenticated attacker to cause a denial-of-service condition.


Microsoft Windows domain controllers running Windows 2000 Server and Server 2003 use the Kerberos protocol for authentication by default. The Kerberos implementation in the affected products is vulnerable to a flaw in handling messages from remote authenticated users. This flaw may allow an attacker to cause the authentication system to stop responding or to forcefully reboot the domain controller.

Systems running the affected products that do not function as domain controllers are not affected. Windows 2000 Professional and Windows XP are not affected. The attacker must have valid logon credentials in order to exploit the vulnerability.


A remote authenticated user that is able to send a specially-crafted message may be able to cause the domain controller authentication service to stop responding, or to force the machine to reboot.


Apply An Update
Please see Microsoft Security Bulletin MS05-042 for information on fixes, updates, and workarounds.

Vendor Information


Microsoft Corporation Affected

Updated:  August 09, 2005



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Please see Microsoft Security Bulletin MS05-042 for information on fixes, updates, and workarounds.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to Microsoft Security Advisory for information on this vulnerability, who in turn thank Tony Chin of Shell, Inc. for reporting the issue.

This document was written by Ken MacInnis.

Other Information

CVE IDs: CVE-2005-1981
Severity Metric: 10.94
Date Public: 2005-08-09
Date First Published: 2005-08-10
Date Last Updated: 2005-08-10 15:08 UTC
Document Revision: 10

Sponsored by CISA.