CVE-2024-43639

FAQ

How could an attacker exploit this vulnerability?

An unauthenticated attacker could use a specially crafted application to leverage a cryptographic protocol vulnerability in Windows Kerberos to perform remote code execution against the target.

Is KDC Proxy Server service (KPSSVC) a dependency of KKDCP?

The vulnerability only exists on the KPSSVC server. We recommend that instances of KPSSVC server be patched immediately.

Must KPSSVC be running for KKDCP to be enabled and functional?

Yes.

Will KPSSVC be started on-demand?

No. You are only vulnerable if you are already using KPSSVC in your environment. KPSSVC is an additional feature Microsoft has been providing since Windows Server 2012. If you do not have it configured in your environment, then this vulnerability is not exploitable.

Are all Windows Servers affected by this vulnerability?

This vulnerability only affects Windows Servers that are configured as a [MS-KKDCP]: Kerberos Key Distribution Center (KDC) Proxy Protocol server. Domain controllers are not affected.