Vulnerability identifier: #VU7466

Vulnerability risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-8495

CWE-ID: CWE-264

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Windows
Operating systems & Components / Operating system
Windows Server
Operating systems & Components / Operating system

Vendor: Microsoft

Description
The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists when Kerberos fails to prevent tampering with the SNAME field during ticket exchange. An attacker who successfully exploited this vulnerability could use it to bypass Extended Protection for Authentication.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Windows: 8.1 - 8.1 RT, 7, 10

Windows Server: 2008 - 2016

---

External links
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8495

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.