Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2020-17049
HistoryNov 11, 2020 - 7:15 a.m.

CVE-2020-17049

2020-11-1107:15:16
CWE-863
[email protected]
web.nvd.nist.gov
711
In Wild
39
20
cve
2020
17049
kerberos
security
feature bypass
vulnerability
nvd

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

<p>A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).</p>
<p>To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.</p>
<p>The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.</p>

Affected configurations

Vulners
NVD
Node
microsoftwindows_server_2019Match10.0.17763.2061
Node
microsoftwindows_server_2019Match10.0.17763.2061
Node
microsoftwindows_server_1909Range10.0.0–10.0.0
Node
microsoftwindows_server_1903Range10.0.0–10.0.0
Node
microsoftwindows_server_2004Match10.0.19041.1110
Node
microsoftwindows_server_2016Match10.0.14393.4530
Node
microsoftwindows_server_2016Match10.0.14393.4530
Node
microsoftwindows_server_2008_sp2Match6.0.6003.21167sp2
Node
microsoftwindows_server_2008_sp2Match6.0.6003.21167sp2
Node
microsoftwindows_server_2008_sp2Match6.0.6003.21167sp2
Node
microsoftwindows_server_2008_r2_sp1Match6.1.7601.25661sp1
Node
microsoftwindows_server_2008_r2_sp1Match6.1.7601.25661sp1
Node
microsoftwindows_server_2012Match6.2.9200.23409
Node
microsoftwindows_server_2012Match6.2.9200.23409
Node
microsoftwindows_server_2012Match6.3.9600.20069r2
Node
microsoftwindows_server_2012Match6.3.9600.20069r2
Node
microsoftwindows_server_20h2Match10.0.19041.1110
VendorProductVersionCPE
microsoftwindows_server_2019*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoftwindows_server_2019*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoftwindows_server,_version_190910.0.0cpe:2.3:o:microsoft:windows_server,_version_1909:10.0.0:*:*:*:*:*:*:*
microsoftwindows_server,_version_190310.0.0cpe:2.3:o:microsoft:windows_server,_version_1903:10.0.0:*:*:*:*:*:*:*
microsoftwindows_server_version_2004*cpe:2.3:o:microsoft:windows_server_version_2004:*:*:*:*:*:*:*:*
microsoftwindows_server_2016*cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoftwindows_server_2016*cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoftwindows_server_2008_sp2*cpe:2.3:o:microsoft:windows_server_2008_sp2:*:sp2:*:*:*:*:*:*
microsoftwindows_server_2008_sp2*cpe:2.3:o:microsoft:windows_server_2008_sp2:*:sp2:*:*:*:*:*:*
microsoftwindows_server_2008_sp2*cpe:2.3:o:microsoft:windows_server_2008_sp2:*:sp2:*:*:*:*:*:*
Rows per page:
1-10 of 171

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2019",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.17763.2061",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2019 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2061:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.17763.2061",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server, version 1909 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_1909:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server, version 1903 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_1903:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server version 2004",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1110:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.19041.1110",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2016",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.14393.4530",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2016 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4530:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.14393.4530",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2008 Service Pack 2",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "6.0.0",
        "lessThan": "6.0.6003.21167",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2008 Service Pack 2 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.0.0",
        "lessThan": "6.0.6003.21167",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2008  Service Pack 2",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21167:*:*:*:*:*:x86:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.0.0",
        "lessThan": "6.0.6003.21167",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2008 R2 Service Pack 1",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.1.0",
        "lessThan": "6.1.7601.25661",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25661:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.0.0",
        "lessThan": "6.1.7601.25661",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2012",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.2.0",
        "lessThan": "6.2.9200.23409",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2012 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23409:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.2.0",
        "lessThan": "6.2.9200.23409",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2012 R2",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.3.0",
        "lessThan": "6.3.9600.20069",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server 2012 R2 (Server Core installation)",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20069:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "6.3.0",
        "lessThan": "6.3.9600.20069",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows Server version 20H2",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_server_20H2:10.0.19041.1110:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.19041.1110",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Social References

More

Related

mskb 41
osv 4
redhat 11
cvelist 1
prion 1
cbl_mariner 1
almalinux 2
openvas 16
nvd 1
attackerkb 1
nessus 21
msrc 1
mscve 1
oraclelinux 2
altlinux 1
redhatcve 1
rocky 1
amazon 1
suse 1
rosalinux 1
kaspersky 2
gentoo 1
avleonov 1
mskb
mskb
July 13, 2021 Public preview security update (KB5004243)
2021-06-02 00:00:00
June 8, 2021 Public preview security update (KB5003645)
2021-05-05 00:00:00
March 9, 2021—KB5000856 (Security-only update)
2021-03-09 08:00:00
osv
osv
Moderate: krb5 security, bug fix, and enhancement update
2023-05-09 00:00:00
CVE-2020-17049
2020-11-11 07:15:16
Moderate: idm:DL1 security update
2024-01-10 00:00:00
redhat
redhat
(RHSA-2023:2570) Moderate: krb5 security, bug fix, and enhancement update
2023-05-09 05:14:28
(RHSA-2024:0143) Moderate: idm:DL1 security update
2024-01-10 12:30:55
(RHSA-2024:0137) Moderate: idm:DL1 security update
2024-01-10 12:11:25
cvelist
cvelist
CVE-2020-17049 Kerberos KDC Security Feature Bypass Vulnerability
2020-11-11 00:00:00
prion
prion
Security feature bypass
2020-11-11 07:15:00
cbl_mariner
cbl_mariner
CVE-2020-17049 affecting package samba 4.12.5-6
2024-07-26 21:09:36
almalinux
almalinux
Moderate: krb5 security, bug fix, and enhancement update
2023-05-09 00:00:00
Moderate: idm:DL1 security update
2024-01-10 00:00:00
openvas
openvas
Samba Security Feature Bypass Vulnerability (CVE-2020-17049)
2021-10-28 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB4592468)
2020-12-09 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB4592484)
2020-12-09 00:00:00
nvd
nvd
CVE-2020-17049
2020-11-11 07:15:16
attackerkb
attackerkb
CVE-2020-17049
2020-11-11 00:00:00
nessus
nessus
RHEL 9 : krb5 (RHSA-2023:2570)
2023-05-11 00:00:00
Oracle Linux 9 : krb5 (ELSA-2023-2570)
2023-05-15 00:00:00
AlmaLinux 9 : krb5 (ALSA-2023:2570)
2023-05-14 00:00:00
msrc
msrc
Kerberos KDC の脆弱性 (CVE-2020-17049) に対応するためのガイダンス
2020-11-19 08:00:00
mscve
mscve
Kerberos KDC Security Feature Bypass Vulnerability
2020-11-10 08:00:00
oraclelinux
oraclelinux
krb5 security, bug fix, and enhancement update
2023-05-15 00:00:00
idm:DL1 security update
2024-01-12 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package samba version 4.14.9-alt1
2021-11-01 00:00:00
redhatcve
redhatcve
CVE-2020-17049
2021-11-22 20:20:39
rocky
rocky
idm:DL1 security update
2024-01-12 19:57:42
amazon
amazon
Important: samba
2022-12-01 17:33:00
suse
suse
Security update for samba and ldb (important)
2021-11-10 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2450
2024-07-15 08:46:32
kaspersky
kaspersky
KLA12003 Multiple vulnerabilities in Microsoft Products (ESU)
2020-11-10 00:00:00
KLA12004 Multiple vulnerabilities in Microsoft Windows
2020-11-10 00:00:00
gentoo
gentoo
Samba: Multiple Vulnerabilities
2023-09-17 00:00:00
avleonov
avleonov
Vulristics Vulnerability Score, Automated Data Collection and Microsoft Patch Tuesdays Q4 2020
2021-01-11 01:50:44

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON
Related for CVE-2020-17049
mskb41osv4redhat11cvelist1prion1cbl_mariner1almalinux2openvas16nvd1attackerkb1nessus21msrc1mscve1oraclelinux2altlinux1redhatcve1rocky1amazon1suse1rosalinux1kaspersky2gentoo1avleonov1