KB5021131: Managing Kerberos protocol changes related to CVE-2022-37966 (2023)

FAQs

What is CVE-2022-37966? ›

Certain versions of Fedora from Fedoraproject contain the following vulnerability: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability. CVE-2022-37966 has been assigned by. secure@microsoft.com to track the vulnerability - currently rated as HIGH severity.

Resolution. To resolve this problem, update the registry on each computer that participates in the Kerberos authentication process, including the client computers. We recommend that you update all of your Windows-based systems, especially if your users have to log on across multiple domains or forests.

With the November 2022 security update, some things were changed as to how the Kerberos Key Distribution Center (KDC) Service on the Domain Controller determines what encryption types are supported by the KDC and what encryption types are supported by default for users, computers, Group Managed Service Accounts (gMSA), ...

common vulnerabilities and exposures (CVE)

Although Kerberos is found everywhere in the digital world, it is employed heavily on secure systems that depend on reliable auditing and authentication features. Kerberos is used in Posix authentication, and Active Directory, NFS, and Samba. It's also an alternative authentication system to SSH, POP, and SMTP.

Kerberos is used to authenticate entities requesting access to network resources, especially in large networks to support SSO. The protocol is used by default in many widely used networking systems. Some systems in which Kerberos support is incorporated or available include the following: Amazon Web Services.

How to check and delete Kerberos tickets: To view or delete Kerberos tickets you can use the Kerberos List (Klist.exe). The Klist.exe is a command-line tool you can find in the Kerberos resource kit. You can only use it to check and delete tickets from the current logon session.

Open Microsoft PowerShell and run the command klist purge to clear the Kerberos ticket cache.

How do I disable Kerberos authentication in Chrome? ›

This problem can occur when a domain controller doesn't have a certificate installed for smart card authentication (for example, with a "Domain Controller" or "Domain Controller Authentication" template), the user's password has expired, or the wrong password was provided.

Every AD domain has an associated KRBTGT account to encrypt and sign all Kerberos tickets for the domain. The KRBTGT account should stay disabled.

To determine whether a problem is occurring with Kerberos authentication, check the System event log for errors from any services (such as Kerberos, kdc, LsaSrv, or Netlogon) on the client, target server, or domain controller that provide authentication.

Can Hackers Use CVE to Attack My Organization? Yes, hackers can use CVE to attack your organization. While it works to your benefit to identify vulnerabilities, hackers are also on the lookout for which of these vulnerabilities they can exploit.

Incomplete information: A Published CVE Record may lack sufficient information for the vulnerability to be re-created by a CVE Program stakeholder. In this case, the technology vendor, maintainer, or third party may dispute the CVE Record.

CVE is sponsored by the US Federal Government, with both the US Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) contributing operating funds. CVE is publicly available and free for anyone to use.

Kerberos clients need to send UDP and TCP packets on port 88 and receive replies from the Kerberos servers.

Ports 88 and 464 are the standard ports for Kerberos authentication. These ports are configurable. Port 464 is only required for password change operations. Ports 88 and 464 can use either the TCP or UDP protocol depending on the packet size and your Kerberos configuration, see Section 2.2.

Kerberos implementations are used on a number of operating systems and networking systems to verify user accounts. Examples include: Amazon Web Services (AWS) Google Cloud.

Has Kerberos been hacked? ›

Yes. Because it is one of the most widely used authentication protocols, hackers have developed several ways to crack into Kerberos. Most of these hacks take advantage of a vulnerability, weak passwords, or malware – sometimes a combination of all three.

The Kerberos SSO extension also helps your users manage their Active Directory accounts. Additionally, it allows users to change their Active Directory passwords and notifies them when a password is close to expiring.

Kerberos is an exploitation attack that extracts service account credentials with a combination of weak encryption and poor service account passwords.

The section Web Services Authentication provides information about the Kerberos authentication in Web services published by Virtual DataPort. To configure the Administration Tool, click the menu Tools > Admin Tool preferences. In this wizard, provide the following details: Select Kerberos authentication.

These policy settings are located in \Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy.

To deactivate Kerberos event logging, delete the LogLevel registry key value or change its value data to 0 .

The cached credentials are stored in the local machine's registry inside of the HKEY_LOCAL_MACHINE\Security\Cache key, which contains sub-keys NL$1 to NL$10. The last 10 users' login username and password verifier are stored as the values of each of these keys.

Google Chrome supports Kerberos authentication. If you configure Internet Explorer, then no additional settings are required for Google Chrome because it uses Internet Explorer settings.

How do I enable Kerberos authentication in Chrome? ›

How to Enable Kerberos Authentication in Google Chrome. You can configure these setting using GPO for Chrome (AuthServerWhitelist policy) or using the registry parameter AuthNegotiateDelegateWhitelist located in registry key HKLM\SOFTWARE\Policies\Google\Chrome (How to deploy a registry keys using GPO).

The main difference between NTLM and Kerberos is in how the two protocols manage authentication. NTLM relies on a three-way handshake between the client and server to authenticate a user. Kerberos uses a two-part process that leverages a ticket granting service or key distribution center.

An "Authentication Failed" error means the email server cannot verify that your email access is authorized. This is typically due to a mistyped password, but it can also be caused by an incorrect username, connecting to the wrong server, or blacklisting.

If you receive this error message, that means that the username and/or password that you have entered is incorrect. The error message states “Authentication failed! Try again.” You may have locked your account after too many attempts and your account will need to be reset.

The primary weakness of Kerberos is that the KDC stores the keys of all principals (clients and servers). A compromise of the KDC (physical or electronic) can lead to the compromise of every key in the Kerberos realm. The KDC and TGS are also single points of failure: if they go down, no new credentials can be issued.

Kerberos is designed to completely avoid storing any passwords locally or having to send any passwords through the internet and provides mutual authentication, meaning both the user and the server's authenticity are verified.

Is it OK to disable the Security Accounts Manager service? The service's description states: Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled.

The built-in Administrator is basically a setup and disaster recovery account. You should use it during setup and to join the machine to the domain. After that you should never use it again, so disable it.

Beginning with Windows 10 version 1507 and Windows Server 2016, Kerberos clients can be configured to support IPv4 and IPv6 hostnames in SPNs. By default Windows will not attempt Kerberos authentication for a host if the hostname is an IP address.

What is the CVE for PrintNightmare? ›

(Updated July 2, 2021) For new information and mitigations, see Microsoft's updated guidance for the Print spooler vulnerability (CVE-2021-34527) .

CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints. Log4j2 allows Lookup expressions in the data being logged exposing the JNDI vulnerability, as well as other problems, to be exploited by end users whose input is being logged.

Certain versions of Chrome from Google contain the following vulnerability: Type confusion in V8 in Google Chrome prior to 99.0. 4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

PrintNightmare was a critical security vulnerability affecting the Microsoft Windows operating system. The vulnerability occurred within the print spooler service. There were two variants, one permitting remote code execution (CVE-2021-34527), and the other leading to privilege escalation (CVE-2021-1675).

PrintNightmare is considered extremely dangerous for two main reasons. First, Windows Print Spooler being enabled by default on all Windows-based systems, including domain controllers and computers with system admin privileges, makes all such computers vulnerable.

Microsoft's PrintNightmare update is causing a lot of problems with network printers mapped on a print server - Microsoft Q&A. This browser is no longer supported. Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

You can safely remove these files. Also, these files don't include the log4j-core-2.7. jar which is the jar containing the vulnerability, so there is no exploit risk.

Any business that uses a vulnerable Log4j library to parse log data in their backend systems is vulnerable to a Log4j cyberattack. This logger is capable of executing code based on input, and because the vulnerability allows attackers to manipulate input data, the logger could be forced to execute malicious code.

“Google is aware that an exploit for CVE-2022-1096 exists in the wild,” the company notes in its advisory, without providing further details on the vulnerability itself or on the observed exploitation. A patch for this flaw has been included in Chrome 99.0.

What is the latest Google Chrome vulnerability? ›

Google Chrome “SymStealer” Vulnerability: How to Protect Your Files from Being Stolen. The Imperva Red Team recently disclosed a vulnerability, dubbed CVE-2022-3656, affecting over 2.5 billion users of Google Chrome and Chromium-based browsers.

In June of 2021, after we installed a patch from MS, users couldn't connect to network printers without having admin right. Per Microsoft, the patch named KB5005625 released on Sept 21, 2021 which was superseded by KB5012647 would fix the issue for good.

November 8, 2022 update – Microsoft released security updates for CVE-2022-41040 and CVE-2022-41082. We recommend that customers protect their organizations by applying the updates immediately to affected systems.

To exploit the PrintNightmare vulnerability using the MS-PAR protocol, the attacker will need: Print Spooler service running on the target machine and allowing remote connections (enabled by default). Username and password of any user in the domain.