Kerberos privilege escalation in Microsoft Windows and Windows Server - CVE-2016-3237

Vulnerability details

The vulnerability allows an attacker with access to local network to gain elevated privileges.

The vulnerability exists in Kerberos implementation when handling password change request. A local attacker can make the operating system to fall back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol.

Successful exploitation of this vulnerability will allow a local attacker to launch a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine, intercept and decrypt credentials during password change request.

Affected software

How to mitigate CVE-2016-3237

Links to Public Exploits and PoC-codes

• Exploit #384 - Microsoft Windows Kerberos - Security Feature Bypass (MS16-101) (March 18, 2020)

External References

• https://technet.microsoft.com/en-us/library/security/ms16-101.aspx

Related Security Bulletins

• Escalation of privileges in Kerberos and NetLogon implementation in Microsoft Windows
• Kerberos Security Feature Bypass Vulnerability
• Security Update for Windows Authentication Methods
• Kerberos Security Feature Bypass Vulnerability