CVE-2014-6324

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspxNot Applicable, Vendor Advisory
http://marc.info/?l=bugtraq&m=142350249315918&w=2Mailing List, Third Party Advisory
http://secunia.com/advisories/62556Broken Link
http://www.securityfocus.com/bid/70958Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031237Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/ncas/alerts/TA14-323AThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068Patch, Vendor Advisory
http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspxNot Applicable, Vendor Advisory
http://marc.info/?l=bugtraq&m=142350249315918&w=2Mailing List, Third Party Advisory
http://secunia.com/advisories/62556Broken Link
http://www.securityfocus.com/bid/70958Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031237Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/ncas/alerts/TA14-323AThird Party Advisory, US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6324US Government Resource

Timeline

Published: Nov 18, 2014
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2014

CVE-2014-63254.3Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arb CVE-2014-63264.3Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arb CVE-2014-63279.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf CVE-2014-63285.0Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML d CVE-2014-63299.3Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf CVE-2014-63309.3Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft CVE-2014-63315.0Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, do CVE-2014-63328.8OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, W CVE-2014-63339.3Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Offic CVE-2014-63349.3Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o CVE-2014-63359.3Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial o CVE-2014-63363.5Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which all