Kerberos Security Feature Bypass Vulnerability (Important, CVE-2020-17049, CVSSv3 6.6)

Reading Time: 3 minutes

Yesterday, for its November 2020 Patch Tuesday, Microsoft released an important security update for Active Directory Domain Services (AD DS).

 

About the vulnerability

A Kerberos Security Feature Bypass vulnerability exists in Microsoft’s implementation of the Kerberos network authentication protocol.

This vulnerability is described in detail in CVE-2020-17049.

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD. For this reason, Microsoft is requiring Kerberos Ticket Signatures.

Note:
The October 2020 cumulative update for Windows Server enforces Kerberos Ticket Signatures, by default. The PerformTicketSignature registry value is available to transition complex Active Directory environments by controlling this behavior on a per-Domain Controller basis. The registry value kan have the following data:

  • 0 – disables Kerberos Ticket Signatures. Domains are not protected

Important:
Do not use this setting. There is a known issue that could cause the S4USelf feature of Kerberos to become non-functional.

  • 1 – enables the fix, but the Domain Controller does not require that Kerberos tickets conform to the fix
  • 2 – enables the fix in required mode, where all Active Directory domains must be patched and all Domain Controllers require Kerberos tickets with signatures

A later release will remove this registry key and make ticket signatures required.

AFFECTED OPERATING SYSTEMS

This security update is rated with a CVSS version 3 score of 6.6 for the following releases of Windows Server:

  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2016
  • Windows Server 2019
  • Windows Server, version 1903
  • Windows Server, version 1909
  • Windows Server, version 2004
  • Windows Server, version 20H2

Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

However, in complex domain environments requiring Kerberos Ticket Signatures may break functionality. A registry key is made available to allow for deployment across domains before fully enabling the fix. In a complex forest, where Kerberos tickets may travel across multiple domains, Microsoft recommends the following steps:

  1. Open the Registry Editor (RegEdit.exe)
  2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Kdc
  3. Locate the PerformTicketSignature value.
  4. Set the registry key to 1.
  5. Complete the deployment to all Domain Controllers and Read-Only Domain Controllers in your Active Directory forest.
  6. When deployment is complete, set the registry key to 2.

Known Issues

When the registry key is set to 1, patched Domain Controllers will issue service tickets that are not renewable and will refuse to renew existing service tickets. Windows clients are not impacted by this since they never renew service tickets. Third-party Kerberos clients may fail to renew service tickets acquired from unpatched DCs. If all DCs are patched with the registry set to 1, third-party clients will no longer receive renewable tickets.

Acknowledgements

Jake Karnes at NetSPI responsibly disclosed the vulnerability to Microsoft.

 

Call to action

I urge you to install the necessary security updates  on Windows Server installations, acting as Domain Controllers and Read-only Domain Controllers, in a test environment as soon as possible, assess the risk and possible impact on your production environment and then, roll out this update to Windows Server installations, acting as Domain Controllers and Read-only Domain Controllers, in the production environment.

Active Directory Admins who cannot require Kerberos Ticket Signatures, should update their Domain Controllers and Read-only Domain Controllers, but implement the registry key on Domain Controllers that service non-capable devices and/or interact with non-capable Domain Controllers.

Further reading

Kerberos Security Feature Bypass Vulnerability

4 Responses to Kerberos Security Feature Bypass Vulnerability (Important, CVE-2020-17049, CVSSv3 6.6)

  1.  

    Hey Sander. 🙂

    In your steps above…

    Step 4… Set value to 1 (note that the reg value may not exist after the update, it may have to be created)

    Step 6… Set value to 1. Did you intend to have this actually be set value to 2?

    Love ya man!

    joe

    • Nice spot, Joe.

      Microsoft seemed fumbling around with the registry values.
      I tried to incorporate as best as possible, but this one slipped through.
      I changed it now, to 2.

      Cheers!

       
  2.  

    Hey Sander,
    What if the registry value does not exist do we still need to create this? And must it be set to 1 or 2?

    Thanks!

    • Hi Roy,

      If you have the November 17/19 follow-up updates installed on your Domain Controllers, Windows Server interprets the absence of the registry value as 2. If you do not have the follow-up updates installed, it interprets the absence of the registry value as 1.

      On systems without the follow-up updates and in multi-domain environments, I would create the registry value manually and set it to 2, ultimately. Please install the follow-up updates as soon as possible in your environment, though. After the follow-up updates are installed, you can delete the registry value.
      On systems with the follow-up updates installed and in environments where you don't use cross-domain S4UProxy delegation, you don't have to create the registry value.

       

leave your comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.