Tom Gilis

The issue is related to errors in LDAP authentication handling, which can be exploited by man-in-the-middle attackers to gain privileges. This is achieved by modifying group-policy update data within a domain-controller data stream. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the manipulation of LDAP authentication, allowing attackers to elevate their privileges.

The issue is related to the Kerberos component in Microsoft Windows, which does not properly validate password changes. This allows remote attackers to bypass authentication by deploying a crafted Key Distribution Center (KDC) and then performing a sign-in action. The vulnerability is also related to errors in managing registration data, which can be exploited by a local attacker to bypass the authentication procedure. Additionally, the vulnerability can be used to bypass Kerberos authentication on a target machine and decrypt drives protected by BitLocker.