# MA-431.112014: MyCERT Alert - Microsoft Security Bulletin MS14-068 - Critical

**Date:** 25 Nov 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-431.112014  
**Advisory ID:** MA-431.112014

---

**1.0 Introduction**
Microsoft has released security updates to address a remote elevation of privilege vulnerability which exists in implementations of Kerberos KDC in Microsoft Windows. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. The security update addresses the vulnerability by correcting signature verification behavior in Windows implementations of Kerberos.
**2.0 Kerberos Checksum Vulnerability – CVE-2014-6324**
A remote elevation of privilege vulnerability exists in implementations of Kerberos KDC in Microsoft Windows. The vulnerability exists when the Microsoft Kerberos KDC implementations fail to properly validate signatures, which can allow for certain aspects of a Kerberos service ticket to be forged. Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability. Note that the known attacks did not affect systems running Windows Server 2012 or Windows Server 2012 R2. The update addresses the vulnerability by correcting signature verification behavior in Windows implementations of Kerberos.
**3.0 Affected Software**
This security update is rated Critical for all supported editions of:
- Windows Server 2003
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012
- Windows Server 2012 R2
- Windows Vista
- Windows 7
- Windows 8
- Windows 8.1
**4.0 Impact**
An unprivileged domain user may escalate to domain administrator privileges, allowing the user to fully compromise any computer on the domain, including the domain controller.
**5.0 Recommendation**
Microsoft has released an update addressing this vulnerability. Kindly refer to [Microsoft Security Bulletin MS14-068](https://technet.microsoft.com/library/security/MS14-068). Users are recommended to perform the update immediately. All of the patches could be done almost automatically via the Windows Update application.
The how-to perform of the Windows Update is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 References**
- US-CERT: Microsoft Releases Out-of-Band Security Bulletin for Windows Kerberos Vulnerability, <https://www.us-cert.gov/ncas/current-activity/2014/11/18/Microsoft-Releases-Patch-MS14-068-Vulnerability>
- Microsoft Security Bulletin MS14-068 – Critical, <https://technet.microsoft.com/library/security/MS14-068>
- US-CERT: Microsoft Windows Kerberos KDC Remote Privilege Escalation Vulnerability, <https://www.us-cert.gov/ncas/alerts/TA14-323A>