Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.6
CVSSv3

CVE-2020-17049

Published: 11/11/2020 Updated: 31/12/2023
CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8
CVSS v3 Base Score: 6.6 | Impact Score: 5.9 | Exploitability Score: 0.7
VMScore: 805
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Subscribe to Windows Server 2012

Vulnerability Summary

<p>A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).</p> <p>To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.</p> <p>The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.</p>

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows server 2012 r2

microsoft windows server 2016 -

microsoft windows server 2012

microsoft windows server 2019 -

microsoft windows server 2016 1903

microsoft windows server 2016 1909

microsoft windows server 2016 2004

microsoft windows server 2016 20h2

samba samba

Vendor Advisories

Red Hat: Moderate: idm:DL1 security update
Synopsis Moderate: idm:DL1 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security ...
Red Hat: Moderate: idm:DL1 security update
Synopsis Moderate: idm:DL1 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Security ...
Red Hat: Moderate: krb5 security update
Synopsis Moderate: krb5 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for krb5 is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rated this u ...
Red Hat: Moderate: idm:DL1 security update
Synopsis Moderate: idm:DL1 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the idm:DL1 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Red Hat: Important: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
Synopsis Important: Red Hat OpenShift Data Foundation 4130 security and bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4130 on Red Hat Enterprise Linux 9Red Hat ...
Red Hat: Important: OpenShift Container Platform 4.13.2 bug fix and security update
Synopsis Important: OpenShift Container Platform 4132 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4132 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...
Amazon Linux AMI: ALAS-2022-1642
It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U), did not sufficiently protect the tickets it's providing from tempering A malicious, authenticated service principal allowed to delegate could use this flaw to impersonate a non-forwardable user (CVE-2020-17049) A flaw was found in Samba Some ...
Amazon Linux 2022: ALAS-2022-213
ALAS-2022-213 Amazon Linux 2022 Security Advisory: ALAS-2022-213 Advisory Release Date: 2022-12-06 16:41 Pacific ...

Mailing Lists

Full Disclosure: Fwd: Samba 4.15.2, 4.14.10, 4.13.14 Security Releases are available for Download
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Fwd: Samba 4152, 41410, 41314 Security Releases are available for Download <!--X-Subject-Header-End--> <!--X-Head-of-Mes ...

Github Repositories

https://github.com/RkDx/MyRuby

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/OsandaMalith/Rubeus

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/merlinepedra25/RUBEUS

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/merlinepedra/RUBEUS

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/mandradets/Maritest2

test

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/aymankhder/security_resources

Security Resources 📖 Links to online resources &amp; tools we use during our web application / network security courses You can create a PR or open an issue if you think we missed a useful resource Short URL: gitio/secres Compass Security 🧭 Compass Security: compass-securitycom/de/ Compass Security Blog: blogcompass-securitycom/ Hacking

https://github.com/merlinepedra25/RUBEUS-1

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/merlinepedra/RUBEUS-1

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/GhostPack/Rubeus

Trying to tame the three-headed dog.

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/qobil7681/Password-cracker

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/Pascal-0x90/Rubeus

Rubeus Rubeus is a C# toolset for raw Kerberos interaction and abuses It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 40 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v30 license) Full credit goes to Benjamin and Vincent for working out the hard components of weaponization- without their prior work this project would not

https://github.com/RedTeamWing/Hunting-Active-Directory

个人整理的一些域渗透Tricks，可能有一些错误。

Hunting-Active-Directory 个人整理的一些域渗透Tricks，可能有一些错误。 信息收集 常用命令 Net use Net view Tasklist /v Ipconfig /all net group /domain 获得所有域用户组列表 net group "domain admins" /domain 获得域管理员列表 net group "enterprise admins" /domain 获得企业管理员列表 net localgroup administra

https://github.com/CompassSecurity/security_resources

Collection of online security resources

Security Resources 📖 Links to online resources &amp; tools we use during our web application / network security courses You can create a PR or open an issue if you think we missed a useful resource Short URL: gitio/secres Compass Security 🧭 Compass Security: compass-securitycom/de/ Compass Security Blog: blogcompass-securitycom/ Hacking

References

CWE-863https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17049http://www.openwall.com/lists/oss-security/2021/11/10/3https://security.gentoo.org/glsa/202309-06https://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2024:0139https://github.com/mandradets/Maritest2https://alas.aws.amazon.com/ALAS-2022-1642.html
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook