CVE-2005-1981

An attacker must have valid logon credentials to exploit this vulnerability; it cannot be exploited by anonymous users [ref_id=1]. The attacker sends a specially crafted Kerberos message to a domain controller on UDP or TCP port 88. This causes the Kerberos service responsible for authenticating users in an Active Directory domain to stop responding, triggering a 60-second countdown followed by an automatic system restart [ref_id=1].

The vulnerability exists in the Kerberos authentication service on Windows 2000 Server and Windows Server 2003 domain controllers. The advisory states that "the method used by domain controllers to process specially crafted Kerberos messages" is at fault [ref_id=1]. No specific function or file names are disclosed in the bulletin.

The security update "removes the vulnerability by modifying the way that Kerberos processes the specially crafted message" [ref_id=1]. No patch diff is provided in the bundle, so the exact code changes are unknown. The advisory also introduces an optional registry key, RequireAsChecksum, to provide additional protection against related PKINIT vulnerabilities [ref_id=1].