SB2024100868 - Multiple vulnerabilities in Microsoft Windows Kerberos

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2024-38129)

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper authorization in Windows Kerberos, which leads to security restrictions bypass and privilege escalation.

2) Missing Required Cryptographic Step (CVE-ID: CVE-2024-43547)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing required cryptographic step in Windows Kerberos. A remote attacker can gain unauthorized access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-38129
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43547