--- title: Kerberos Vulnerability Exposes Privilege Escalation in Windows description: Microsoft’s MS14-068 update fixes a vulnerability in Windows Kerberos implementations that allows for elevating any domain user to admin privileges. image: https://www.dsr-inc.com/hs-fs/hub/301206/file-2117486700.jpg --- [![DSR Computer Technology Specialist Logo](https://www.dsr-inc.com/hs-fs/file-256108778-gif/images/logo.gif?width=300&name=logo.gif "DSR Computer Technology Specialist Logo")](https://www.dsr-inc.com) [![Request A Quote Now](https://no-cache.hubspot.com/cta/default/301206/bc46fe45-9f35-4a70-a619-9bbe8763f2f6.png)](https://cta-redirect.hubspot.com/cta/redirect/301206/bc46fe45-9f35-4a70-a619-9bbe8763f2f6) # The Official DSR Blog - Computer Technology, Networking and Repair ![The Official DSR Blog](https://www.dsr-inc.com/hs-fs/file-646870432-jpg/img/hero/blog.jpg?width=1400&name=blog.jpg "The Official DSR Blog") ## [Kerberos Vulnerability Exposes Privilege Escalation in Windows](https://www.dsr-inc.com/blog/kerberos-vulnerability-exposes-privilege-escalation-in-windows) By [Viral Mehta](https://www.dsr-inc.com/blog/author/viral-mehta) on November 20, 2014 - [Tweet](https://twitter.com/share) ![bitdefender_advisory](https://www.dsr-inc.com/hs-fs/hub/301206/file-2117486700.jpg) Microsoft’s MS14-068 update fixes a vulnerability in Windows Kerberos implementations that allows attackers to elevate any domain user privileges to administrator privileges. Microsoft has warned that the exploit has been found in the wild deemed the patch “critical.” The company advises system administrators to immediately install it.  If an attacker were to have valid domain credentials, he could exploit the vulnerability (CVE-2014-6324) to elevate his privileges and compromise any computer in the domain, including domain controllers.  The vulnerability exploits the way Windows Kerberos validates the Privilege Attribute Certificate (PAC) in the Kerberos tickets. If an attacker can forge a PAC and get the Kerberos KDC (Key Distribution Center) to incorrectly validate it, he can elevate his system privileges to Admin and perform any changes to the domain. This will give him a permanent foothold lasting long after the patch has been installed and forcing administrators to perform a complete domain rebuild to remediate any issues.  The Microsoft patch corrects the signature verification in Windows implementations of Kerberos, plugging the issue.    Domain controllers running Windows Server 2008R2 and below are exposed to the vulnerability, but Microsoft warns that domain controllers running 2012 and above are also exposed. Although significantly more difficult to exploit, they are still exposed to a related attack.  A “defense-in-depth” update will also be released for Windows Vista, Windows 7, Windows 8 and Windows 8.1, although they have not been deemed vulnerable.  Administrators are advised to collect event logs from domain controllers to identify possible signs of intrusions. Post update, attempts at exploiting the vulnerability can be identified by using the 4769 Kerberos Service Ticket Operation event log. Setting it to only log failures that result in “Failed Code: 0xf” will significantly increase changes of catching exploitation events. Although there’s a small chance of non-malicious behavior, in most cases it’s a clear sign of intrusion attempts.    For more information about the Microsoft [MS14-068](https://connect.bitdefender.com/pub/cc?_ri_=X0Gzc2X%3DWQpglLjHJlYQGpjItn6IeaXkdw3Czb0qvh911zdoMbbqRzbPhzeMNLze4VXtpKX%3DSRRSDYBT&_ei_=EolaGGF4SNMvxFF7KucKuWNvhI1tFacTgDv9d3jqbrjLUcI.) patch and affected systems, please refer to the embedded link.    *Is your business protected? Click [here](https://info.dsr-inc.com/request-your-complimentary-bitdefender-demo) to request a complimentary bitdefender demo for your organization. Bitdefenders #1 rated technologies provide excellent protection and security for your organization that are simple and easy to manage. Our [network services](https://www.dsr-inc.com/computer-network-security-maryland) division looks forward to assiting you. * Topics: [Business IT](https://www.dsr-inc.com/blog/topic/business-it) #### About the Author **Viral Mehta** ### Subscribe to our Blog ### Most Popular Posts ### Browse by Topic - [Computer Repair (22)](https://www.dsr-inc.com/blog/topic/computer-repair) - [Business IT (20)](https://www.dsr-inc.com/blog/topic/business-it) - [Productivity (11)](https://www.dsr-inc.com/blog/topic/productivity) - [Computers in the Classroom (6)](https://www.dsr-inc.com/blog/topic/computers-in-the-classroom) - [Ultrabooks (5)](https://www.dsr-inc.com/blog/topic/ultrabooks) - [Consumer Technology (4)](https://www.dsr-inc.com/blog/topic/consumer-technology) - [Press Release (2)](https://www.dsr-inc.com/blog/topic/press-release) - [PC Refresh (1)](https://www.dsr-inc.com/blog/topic/pc-refresh) - [Servers (1)](https://www.dsr-inc.com/blog/topic/servers) - [Windows XP End-Of-Life (1)](https://www.dsr-inc.com/blog/topic/windows-xp-end-of-life) - [baltimore networking solutions (1)](https://www.dsr-inc.com/blog/topic/baltimore-networking-solutions) - [managed services baltimoe (1)](https://www.dsr-inc.com/blog/topic/managed-services-baltimoe) - [network service agreement (1)](https://www.dsr-inc.com/blog/topic/network-service-agreement) - [network services (1)](https://www.dsr-inc.com/blog/topic/network-services) [see all](https://www.dsr-inc.com/blog/kerberos-vulnerability-exposes-privilege-escalation-in-windows#) ### Contact us for a **FREE QUOTE** today! [![Request A Quote Now](https://no-cache.hubspot.com/cta/default/301206/bc46fe45-9f35-4a70-a619-9bbe8763f2f6.png)](https://cta-redirect.hubspot.com/cta/redirect/301206/bc46fe45-9f35-4a70-a619-9bbe8763f2f6) --- *Offering Business Computers For Sale, Expert Computer Repair & Computer Network Consulting in Baltimore, Maryland Serving Customers in Hanover, Annapolis, Glen Burnie, Bowie, Crofton, Severna Park, Pasadena, Columbia, Ellicott City, Laurel and Elkridge Since 1986!* --- **Stay Connected:** [Facebook](http://www.facebook.com/pages/DSR-Inc/292848524107265) [Twitter](https://twitter.com/DSR_Inc) [LinkedIn](http://www.linkedin.com/company/dsr-inc-) [Google+](https://plus.google.com/115134803149679023823/about) © 2014 DSR, Inc. [Website Design](https://smartbugmedia.com) by [SmartBug Media](https://smartbugmedia.com)