Yesterday, for its November 2020 Patch Tuesday, Microsoft released an important security update for Active Directory Domain Services (AD DS).

About the vulnerability

A Kerberos Security Feature Bypass vulnerability exists in Microsoft’s implementation of the Kerberos network authentication protocol.

This vulnerability is described in detail in CVE-2020-17049.

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD. For this reason, Microsoft is requiring Kerberos Ticket Signatures.

Note:
The October 2020 cumulative update for Windows Server enforces Kerberos Ticket Signatures, by default. The PerformTicketSignature registry value is available to transition complex Active Directory environments by controlling this behavior on a per-Domain Controller basis. The registry value kan have the following data:

• 0 – disables Kerberos Ticket Signatures. Domains are not protected

Important:
Do not use this setting. There is a known issue that could cause the S4USelf feature of Kerberos to become non-functional.

• 1 – enables the fix, but the Domain Controller does not require that Kerberos tickets conform to the fix
• 2 – enables the fix in required mode, where all Active Directory domains must be patched and all Domain Controllers require Kerberos tickets with signatures

A later release will remove this registry key and make ticket signatures required.

AFFECTED OPERATING SYSTEMS

This security update is rated with a CVSS version 3 score of 6.6 for the following releases of Windows Server:

• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server, version 1903
• Windows Server, version 1909
• Windows Server, version 2004
• Windows Server, version 20H2

Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

However, in complex domain environments requiring Kerberos Ticket Signatures may break functionality. A registry key is made available to allow for deployment across domains before fully enabling the fix. In a complex forest, where Kerberos tickets may travel across multiple domains, Microsoft recommends the following steps:

1. Open the Registry Editor (RegEdit.exe)
2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Kdc
3. Locate the PerformTicketSignature value.
4. Set the registry key to 1.
5. Complete the deployment to all Domain Controllers and Read-Only Domain Controllers in your Active Directory forest.
6. When deployment is complete, set the registry key to 2.

Known Issues

When the registry key is set to 1, patched Domain Controllers will issue service tickets that are not renewable and will refuse to renew existing service tickets. Windows clients are not impacted by this since they never renew service tickets. Third-party Kerberos clients may fail to renew service tickets acquired from unpatched DCs. If all DCs are patched with the registry set to 1, third-party clients will no longer receive renewable tickets.

Acknowledgements

Jake Karnes at NetSPI responsibly disclosed the vulnerability to Microsoft.

Call to action

I urge you to install the necessary security updates  on Windows Server installations, acting as Domain Controllers and Read-only Domain Controllers, in a test environment as soon as possible, assess the risk and possible impact on your production environment and then, roll out this update to Windows Server installations, acting as Domain Controllers and Read-only Domain Controllers, in the production environment.

Active Directory Admins who cannot require Kerberos Ticket Signatures, should update their Domain Controllers and Read-only Domain Controllers, but implement the registry key on Domain Controllers that service non-capable devices and/or interact with non-capable Domain Controllers.

Further reading

Kerberos Security Feature Bypass Vulnerability

The post Kerberos Security Feature Bypass Vulnerability (Important, CVE-2020-17049, CVSSv3 6.6) appeared first on The things that are better left unspoken.