Software Engineering Institute

Microsoft Windows 2000 uses Kerberos as its default means of authentication. Kerberos is a trusted-third-party scheme that is used to perform mutual authentication between two network entities who trust a "neutral" third party, known as a key distribution center (KDC). In the Microsoft implementation of Kerberos, a domain controller serves as the KDC. By making certain kinds of invalid Kerberos requests to a Windows 2000 domain controller repeatedly, an intruder can exhaust the available memory of the system, effectively rendering it incapable of processing further Kerberos requests, possibly interrupting the ordinary operation of other services on that same machine, and severely impacting system performance. In order to recover the memory, a system administrator must reboot the machine.

More information about this problem is available in Microsoft Security Bulletin MS 01-024, and an advisory issued by Defcom Labs, who originally discovered the problem.

Note that a casual reader of the Microsoft advisory may not appreciate the scope of this vulnerability. Quoting from their advisory:

If there were multiple domain controllers on the domain, the unaffected machines could pick up the other machine’s load. 

The KDC is located on every domain controller, as is the Active Directory service. Both services are started automatically by the domain controller's Local Security Authority (LSA) and run in the process space of the LSA. Neither service can be stopped. Windows 2000 ensures availability of these services by allowing each domain to have several domain controllers, all peers. Any domain controller can accept authentication requests and ticket-granting requests addressed to the domain's KDC.

Intruders can disable domain controllers, effectively halting the processing of logon requests and the granting of new Kerberos tickets.

Apply a patch as described in Microsoft Security Bulletin MS01-024.

Limiting access to ports 88 and 464 can reduce your exposure to this problem. In general, we recommend blocking access to all ports that aren't explicitly required.