Windows Kerberos is broken?

Microsoft has been investigating a new known issue causing enterprise domain controllers to experience Kerberos authentication problems after installing security updates released to address CVE-2020-17049 during this month’s Patch Tuesday, on November 10.

Kerberos is a client-server authentication protocol used on multiple operating systems, including Windows. 

It replaced the NTLM protocol to be the default authentication protocol for domain connected devices on all Windows versions above Windows 2000.

These protocols enable authentication of users, computers, and services, making it possible for authorized services and users to access resources in a secure manner.

As Microsoft detailed, a security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

But, “After installing KB4586781 on domain controllers (DCs) and read-only domain controllers (RODCs) in your environment, you might encounter Kerberos authentication issues,” Microsoft added.

“This is caused by an issue in how CVE-2020-17049 was addressed in these updates. As noted in CVE-2020-17049, there are three registry setting values for PerformTicketSignature to control it, but in the current implementation you might encounter different issues with each setting.”

Experienced issues include authentication issues when using S4U scenarios, cross-realm referrals failures on Windows and non-Windows devices for Kerberos referral tickets, and certain non-compliant Kerberos tickets being rejected, depending on the value of the PerformTicketSignature setting.

Impacted Windows platforms

Kerberos domain-controlled Windows devices using MIT Kerberos realms impacted by this newly acknowledged issue include both domain controllers and read-only domain controllers as explained by Microsoft.

The server platforms impacted by this issue are listed in the table below, together with the cumulative updates causing domain controllers to encounter Kerberos authentication and ticket renewal problems after installation.

Kerberos in detail

The benefits gained by using Kerberos for domain-based authentication are:

• Delegated authentication.Services that run on Windows operating systems can impersonate a client computer when accessing resources on the client’s behalf. In many cases, a service can complete its work for the client by accessing resources on the local computer. When a client computer authenticates to the service, NTLM and Kerberos protocol provide the authorization information that a service needs to impersonate the client computer locally. However, some distributed applications are designed so that a front-end service must use the client computer’s identity when it connects to back-end services on other computers. Kerberos authentication supports a delegation mechanism that enables a service to act on behalf of its client when connecting to other services.
• Single sign on.Using Kerberos authentication within a domain or in a forest allows the user or service access to resources permitted by administrators without multiple requests for credentials. After initial domain sign on through Winlogon, Kerberos manages the credentials throughout the forest whenever access to resources is attempted.
• Interoperability.The implementation of the Kerberos V5 protocol by Microsoft is based on standards-track specifications that are recommended to the Internet Engineering Task Force (IETF). As a result, in Windows operating systems, the Kerberos protocol lays a foundation for interoperability with other networks in which the Kerberos protocol is used for authentication. In addition, Microsoft publishes Windows Protocols documentation for implementing the Kerberos protocol. The documentation contains the technical requirements, limitations, dependencies, and Windows-specific protocol behavior for Microsoft’s implementation of the Kerberos protocol.
• More efficient authentication to servers.Before Kerberos, NTLM authentication could be used, which requires an application server to connect to a domain controller to authenticate every client computer or service. With the Kerberos protocol, renewable session tickets replace pass-through authentication. The server is not required to go to a domain controller (unless it needs to validate a Privilege Attribute Certificate (PAC)). Instead, the server can authenticate the client computer by examining credentials presented by the client. Client computers can obtain credentials for a particular server once and then reuse those credentials throughout a network logon session.
• Mutual authentication.By using the Kerberos protocol, a party at either end of a network connection can verify that the party on the other end is the entity it claims to be. NTLM does not enable clients to verify a server’s identity or enable one server to verify the identity of another. NTLM authentication was designed for a network environment in which servers were assumed to be genuine. The Kerberos protocol makes no such assumption.