(MS11-013) Vulnerabilities in Kerberos Could Allow Elevation of Privilege (2496930)
Data de publicação: 10 fevereiro 2011
Schweregrad: : Alto
Identificador(es) CVE: : CVE-2011-0043,CVE-2011-0091
Data do informe: 10 fevereiro 2011
Descrição
This security update addresses vulnerabilities in Microsoft Windows with the more severe ones capable of allowing elevation of privilege if a local, authenticated attacker installs a malicious service on a domain-joined computer. More specifically, this update addresses the vulnerabilities by preventing the use of weak hashing algorithms in both Windows Kerberos and Windows KDC and by preventing the client from downgrading the encryption standard to DES for Kerberos communication between client and server.
Note for affected users: *Server Core installation affected. This update applies, with the same severity rating, to supported editions of Windows Server 2008 R2 as indicated, whether or not installed using the Server Core installation option.
Note for affected users: *Server Core installation affected. This update applies, with the same severity rating, to supported editions of Windows Server 2008 R2 as indicated, whether or not installed using the Server Core installation option.
Exposição das informações
For information on patches specific to the affected software, please proceed to the Microsoft Web page.
For Trend Micro clients using Trend Micro Deep Security and OfficeScan with Intrusion Defense Firewall (IDF), please refer to the table below for the filter identifier(s) specific to this advisory's vulnerability identifier(s):
Vulnerability ID | Identifier & Title | IDF First Pattern Version | IDF First Pattern Release Version |
---|---|---|---|
CVE-2011-0091 | 1004591 - Kerberos Spoofing Vulnerability | 11-005 | Feb 09, 2011 |
Software infectado e versão:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems*
- Windows Server 2008 R2 for Itanium-based Systems