Microsoft issues out-of-band patch for domain controllers

Microsoft has released an out-of-band patch for an issue on Windows-based domain controllers which might cause sign-in failures or other Kerberos authentication issues.

Released last month, the patch deals with CVE-2022-37966, an escalation of privilege vulnerability because of a weak Kerberos RC4-HMAC negotiation.

The update — which supersedes an update issued November 8th in the regular Patch Tuesday fixes — will set AES as the default encryption type for session keys on accounts that are not marked with a default encryption type already.

The out-of-band update applies to all versions of Windows Server from 2008 to 2022.

Microsoft rates the complexity of the vulnerability as high. “A successful attack depends on conditions beyond the attacker’s control,” it says in an explanatory note. “That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).”

Administrators don’t need to install any updates or make any changes to servers other than domain controllers, or to client devices in their environment, to resolve this issue.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@] soloreporter.com

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now