AEGLIX vulnerability intelligence
CVE-2014-6324
HIGH · CVSS 8.8 · Analyzed
Published: 2014-11-18 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
Severity and scoring
- CVSS score
- 8.8 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- NVD-CWE-noinfo
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Microsoft · Kerberos Key Distribution Center (KDC)
- Added to catalog
- 2022-03-25
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-04-15
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx
Not Applicable · Vendor Advisory
- http://marc.info/?l=bugtraq&m=142350249315918&w=2
Mailing List · Third Party Advisory
- http://secunia.com/advisories/62556
Broken Link
- http://www.securityfocus.com/bid/70958
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1031237
Broken Link · Third Party Advisory · VDB Entry
- http://www.us-cert.gov/ncas/alerts/TA14-323A
Third Party Advisory · US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068
Patch · Vendor Advisory
- http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx
Not Applicable · Vendor Advisory
- http://marc.info/?l=bugtraq&m=142350249315918&w=2
Mailing List · Third Party Advisory
- http://secunia.com/advisories/62556
Broken Link
- http://www.securityfocus.com/bid/70958
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1031237
Broken Link · Third Party Advisory · VDB Entry
- http://www.us-cert.gov/ncas/alerts/TA14-323A
Third Party Advisory · US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068
Patch · Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6324
US Government Resource