Microsoft has released an out-of-band patch for an issue on Windows-based domain controllers which might cause sign-in failures or other Kerberos authentication issues.
Released last month, the patch deals with CVE-2022-37966, an escalation of privilege vulnerability because of a weak Kerberos RC4-HMAC negotiation.
The update — which supersedes an update issued November 8th in the regular Patch Tuesday fixes — will set AES as the default encryption type for session keys on accounts that are not marked with a default encryption type already.
The out-of-band update applies to all versions of Windows Server from 2008 to 2022.
Microsoft rates the complexity of the vulnerability as high. “A successful attack depends on conditions beyond the attacker’s control,” it says in an explanatory note. “That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).”
Administrators don’t need to install any updates or make any changes to servers other than domain controllers, or to client devices in their environment, to resolve this issue.
