Kerberos privilege escalation in Windows and Windows Server - CVE-2016-3237

Detailed vulnerability description

The vulnerability allows an attacker with access to local network to gain elevated privileges.

The vulnerability exists in Kerberos implementation when handling password change request. A local attacker can make the operating system to fall back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol.

Successful exploitation of this vulnerability will allow a local attacker to launch a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine, intercept and decrypt credentials during password change request.

How to mitigate CVE-2016-3237

Sources

• https://technet.microsoft.com/en-us/library/security/ms16-101.aspx