Riskcovery

CVE-2020-17049

Kerberos KDC Security Feature Bypass Vulnerability

State
Published
Severity
6.6 Medium
Published
Nov 11, 2020
Updated
Nov 15, 2024
Reserved
Aug 4, 2020

Read the record on cve.org

Description

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Scores

CVSSScoreVectorSource
3.16.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Cmicrosoft

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Windows Server 2019Microsoft
  • 10.0.0 to before 10.0.17763.2061Affected
Windows Server 2019 (Server Core installation)Microsoft
  • 10.0.0 to before 10.0.17763.2061Affected
Windows Server, version 1909 (Server Core installation)Microsoft
  • 10.0.0 to before publicationAffected
Windows Server, version 1903 (Server Core installation)Microsoft
  • 10.0.0 to before publicationAffected
Windows Server version 2004Microsoft
  • 10.0.0 to before 10.0.19041.1110Affected
Windows Server 2016Microsoft
  • 10.0.0 to before 10.0.14393.4530Affected
Windows Server 2016 (Server Core installation)Microsoft
  • 10.0.0 to before 10.0.14393.4530Affected
Windows Server 2008 Service Pack 2Microsoft
  • 6.0.0 to before 6.0.6003.21167Affected
Windows Server 2008 Service Pack 2 (Server Core installation)Microsoft
  • 6.0.0 to before 6.0.6003.21167Affected
Windows Server 2008 Service Pack 2Microsoft
  • 6.0.0 to before 6.0.6003.21167Affected
Windows Server 2008 R2 Service Pack 1Microsoft
  • 6.1.0 to before 6.1.7601.25661Affected
Windows Server 2008 R2 Service Pack 1 (Server Core installation)Microsoft
  • 6.0.0 to before 6.1.7601.25661Affected
Windows Server 2012Microsoft
  • 6.2.0 to before 6.2.9200.23409Affected
Windows Server 2012 (Server Core installation)Microsoft
  • 6.2.0 to before 6.2.9200.23409Affected
Windows Server 2012 R2Microsoft
  • 6.3.0 to before 6.3.9600.20069Affected
Windows Server 2012 R2 (Server Core installation)Microsoft
  • 6.3.0 to before 6.3.9600.20069Affected
Windows Server version 20H2Microsoft
  • 10.0.0 to before 10.0.19041.1110Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.