Ticket acquisition fails with KRB_GENERIC_ERROR if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag. This issue occurs after Windows Updates that contains CVE-2020-17049 protections released between November 10 and Decemare installed and PerfromTicketSignature is configured to 1 or higher.
Note This change does not affect customers who use HTTP WSUS servers.Īddresses an issue in which a principal in a trusted Managed Identity for Application (MIT) realm does not obtain a Kerberos Service ticket from Active Directory domain controllers (DCs). To make sure that the highest levels of security, additionally leverage Windows Server Update Services (WSUS) Transport Layer Security (TLS) certificate pinning on all devices. For more information, see Changes to scans, improved security for Windows devices. If you must leverage a user proxy, you must configure the behavior by using the Windows Update policy Allow user proxy to be used as a fallback if detection using system proxy fails. Scans that use these servers will fail if the clients do not have a configured system proxy. After you install this update, HTTPS-based intranet servers cannot leverage a user proxy to detect updates by default.
For more information, see KB4599464.Īddresses a security vulnerability issue with HTTPS-based intranet servers. This security update includes improvements and fixes that were a part of update KB4592471 (released December 8, 2020) and addresses the following issues:Īddresses a security bypass vulnerability that exists in the way the Printer Remote Procedure Call (RPC) binding handles authentication for the remote Winspool interface.
For information about the various types of Windows updates, such as critical, security, driver, service packs, and so on, please see the following article. To view other notes and messages, see the Windows 7 SP1 and Windows Server 2008 R2 SP1 update history home page.
0 kommentar(er)
