When Microsoft released a critical update for multiple versions of Windows Server this month, it also pushed out a fix for several releases of the Windows client OS, including even the technical preview for Windows 10.

It was critical to get the patch out for Windows Server: An exploit affecting Windows Server 2008 R2 and earlier versions has already been detected, and Windows Server 2012 and later releases are vulnerable to a related but more difficult attack.

But the vulnerability isn’t present in the desktop versions of Windows. In Windows Server, the flaw allows attackers to employ the username and password of anyone in an Active Directory domain to get the same system privileges as a domain administrator, using a forged Privilege Attribute Certificate to fool the Kerberos Domain Controller that manages remote access.

To read this article in full or to leave a comment, please click here