PT-2011-2081 · Microsoft · Windows Server 2008 R2+3
Scott Stender
·
Publicado
2011-02-10
·
Atualizado
2018-10-30
·
CVE-2011-0091
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 (affected versions not specified)
Description
A spoofing issue exists in Kerberos implementations, allowing man-in-the-middle attackers to downgrade the encryption from strong encryption to DES, potentially spoofing network traffic and obtaining sensitive information. This occurs because Kerberos authentication can be downgraded to use DES instead of the default stronger encryption standards.
Recommendations
For Windows Server 2008 R2 and Windows 7, consider configuring Kerberos to prevent the use of DES encryption as a temporary workaround until a patch is available.
Restrict access to sensitive information and network resources to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kerberos
Windows
Windows 7
Windows Server 2008 R2