Auth bypass in Microsoft Windows Server 2008 R2 Service Pack 1
CVE-2020-17049
A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.138 (96.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.137 · newest: 0.138 · change: +0.001
Affected products
- Microsoft Windows Server 2008 R2 Service Pack 1 — versions 6.1.0
- Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core Installation) — versions 6.0.0
- Microsoft Windows Server 2008 Service Pack 2 — versions 6.0.0
- Microsoft Windows Server 2008 Service Pack 2 — versions 6.0.0
- Microsoft Windows Server 2008 Service Pack 2 (Server Core Installation) — versions 6.0.0
- Microsoft Windows Server 2012 — versions 6.2.0
- Microsoft Windows Server 2012 — versions r2
- Microsoft Windows Server 2012 R2 — versions 6.3.0
- Microsoft Windows Server 2012 R2 (Server Core Installation) — versions 6.3.0
- Microsoft Windows Server 2012 (Server Core Installation) — versions 6.2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17049 (Patch, Vendor Advisory)
- www.openwall.com/lists/oss-security/2021/11/10/3 (mailing-list, Mailing List, Third Party Advisory)
- security.gentoo.org/glsa/202309-06 (vendor-advisory)
Frequently asked questions
- What is CVE-2020-17049?
- CVE-2020-17049 is a medium-severity vulnerability in Microsoft Windows Server 2008 R2 Service Pack 1, classified under Incorrect Authorization. CVSS score: 6.6/10. Published 2020-11-11.
- How severe is CVE-2020-17049?
- Medium severity. CVSS v3 base score is 6.6 out of 10.
- Is CVE-2020-17049 known to be exploited?
- 55 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.