Microsoft issues out-of-band patch for domain controllers

Microsoft has released an out-of-band patch for an issue on Windows-based domain controllers which might cause sign-in failures or other Kerberos authentication issues.

Released last month, the patch deals with CVE-2022-37966, an escalation of privilege vulnerability because of a weak Kerberos RC4-HMAC negotiation.

The update — which supersedes an update issued November 8th in the regular Patch Tuesday fixes — will set AES as the default encryption type for session keys on accounts that are not marked with a default encryption type already.

The out-of-band update applies to all versions of Windows Server from 2008 to 2022.

Microsoft rates the complexity of the vulnerability as high. “A successful attack depends on conditions beyond the attacker’s control,” it says in an explanatory note. “That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).”

Administrators don’t need to install any updates or make any changes to servers other than domain controllers, or to client devices in their environment, to resolve this issue.

The post Microsoft issues out-of-band patch for domain controllers first appeared on IT World Canada.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web