CVE-2020-17049: 
vulnerability analysis and mitigation

CVE-2020-17049 is a security feature bypass vulnerability in the Key Distribution Center (KDC) that affects how service tickets are validated for Kerberos Constrained Delegation (KCD). The vulnerability was disclosed in November 2020 and affects multiple versions of Windows Server and other systems implementing Kerberos authentication (NVD).

The vulnerability exists in the way the Key Distribution Center (KDC) determines whether a Kerberos service ticket can be used for delegation through Kerberos Constrained Delegation (KCD). The issue has a CVSS v3.1 base score of 7.2 (HIGH) according to NVD, while Microsoft assigned it a score of 6.6 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

If exploited, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. This could allow an attacker to bypass security features in the Kerberos authentication system (NVD).

To exploit the vulnerability, an attacker would need to have control of a service that is configured to use Kerberos Constrained Delegation. The attacker could then manipulate service tickets to bypass delegation restrictions (NVD).

Microsoft released updates that address this vulnerability by changing how the KDC validates service tickets used with KCD. The deployment was conducted in three phases: initial deployment (December 2020), second deployment phase (April 2021), and enforcement phase (July 2021). Organizations must install the appropriate updates and enable enforcement mode on all Active Directory domain controllers (Microsoft KB).

The vulnerability has been acknowledged and patched by multiple vendors including Microsoft, Red Hat, and Samba. Samba released security updates addressing this vulnerability along with several other security issues in their versions 4.15.2, 4.14.10, and 4.13.14 (OSS Security).