Re: CVE-2020-17049

Robbie Harwood <[email protected]> Tue, 17 Nov 2020 12:16:20 -0500
Newsgroups	gmane.comp.encryption.kerberos.general
Message-ID	<[email protected]>
Luke Hebert <[email protected]> writes:

> Hi,
>
> We've just started encountering problems at customer sites with Kerberos
> enabled clients as a result of how Microsoft appears to be approaching
> CVE-2020-17049
> <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17049>. The
> details on this CVE are slim on Mitre and there is a small amount of
> additional information on the microsoft portal. I thought I'd ask the list
> what their thoughts are on what is being done here. Disabling service
> ticket and tgt renewability is not great and it obviously breaks long
> running processes that rely on renewability of these items. I'm sure we
> could move to an alternate approach where we do not renew these items but
> rather obtain a new one but the changes are likely non-trivial across many
> different projects.
>
> https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17049
>
>>> *How does this patch affect third-party Kerberos clients?*
>
>>> When the registry key is set to 1, patched domain controllers will issue
> service tickets and Ticket-Granting Tickets (TGT)s that are not renewable
> and will refuse to renew existing service tickets and TGTs. Windows clients
> are not impacted by this since they never renew service tickets or TGTs.
> Third-party Kerberos clients may fail to renew service tickets or TGTs
> acquired from unpatched DCs. If all DCs are patched with the registry set
> to 1, third-party clients will no longer receive renewable tickets.

You're correct that Microsoft has not released details on this issue.

They have indicated that some failures are a known issue, and claim to
be working on a fix:
https://docs.microsoft.com/en-us/windows/release-information/status-windows-10-20h2#1522msgdesc

Thanks,
--Robbie

________________________________________________
Kerberos mailing list           [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
signature.asc (application/pgp-signature, 832 B)