Skip to content
OpenAdvisories
Critical MSRC-CVE-2024-43639 1 CVE

Windows KDC Proxy Remote Code Execution Vulnerability

Published Nov 12, 2024 · Updated Nov 18, 2024 · Revision 3

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An unauthenticated attacker could use a specially crafted application to leverage a cryptographic protocol vulnerability in Windows Kerberos to perform remote code execution against the target.

Is KDC Proxy Server service (KPSSVC) a dependency of KKDCP?
The vulnerability only exists on the KPSSVC server. We recommend that instances of KPSSVC server be patched immediately.
Yes.
No. You are only vulnerable if you are already using KPSSVC in your environment. KPSSVC is an additional feature Microsoft has been providing since Windows Server 2012. If you do not have it configured in your environment, then this vulnerability is not exploitable.

Are all Windows Servers affected by this vulnerability?
This vulnerability only affects Windows Servers that are configured as a [MS-KKDCP]: Kerberos Key Distribution Center (KDC) Proxy Protocol server. Domain controllers are not affected.

Security updates
10.0.26100.2314 — https://support.microsoft.com/help/5046617
10.0.26100.2240 — https://support.microsoft.com/help/5046696
10.0.17763.6532 — https://support.microsoft.com/help/5046615
10.0.20348.2849 — https://support.microsoft.com/help/5046616
10.0.20348.2819 — https://support.microsoft.com/help/5046698
10.0.25398.1251 — https://support.microsoft.com/help/5046618
10.0.14393.7515 — https://support.microsoft.com/help/5046612
6.2.9200.25165 — https://support.microsoft.com/help/5046697
6.3.9600.22267 — https://support.microsoft.com/help/5046682

Vulnerabilities 1

Revision history

  1. #3

    Added FAQs to explain the mitigating circumstances for this vulnerability. KPSSVC is an additional feature Microsoft has been providing since Windows Server 2012. If customers do not have it configured in their environment, then this vulnerability is not exploitable. This is an informational change only.

  2. #2

    Updated the CVE title to better reflect the affected protocol and added an FAQ to explain that only Windows Servers that are configured with the [[MS-KKDCP]: Kerberos Key Distribution Center (KDC) Proxy Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kkdcp/5bcebb8d-b747-4ee5-9453-428aec1c5c38) are affected.

  3. #1

    Information published.

References