Cyber Risks · Unit 42 Palo Alto Networks

DTLS Vulnerabilities in CVE-2014-6321

Summary: Microsoft's MS14-066 patch for CVE-2014-6321 fixed at least two DTLS vulnerabilities in schannel.dll, which Windows Remote Desktop Gateway uses to secure client-server connections. On the server side, DTLSCookieManager::ValidateCookie always reads a 32-byte cookie length without confirming the buffer is readable, allowing an out-of-bounds condition from a crafted packet sent without starting an RDP session; on the client side, CSsl3TlsClientContext::DigestServerHelloVerifyRequest fails to validate a CookieSize over 32 bytes against actual cookie data, allowing a heap overflow.

Bottom line: A single crafted DTLS packet can crash lsass.exe, and the server-side flaw needs no RDP session to trigger - so any exposed Remote Desktop Gateway is reachable by an attacker who never authenticates.

Read the original at Unit 42 Palo Alto Networks ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2014-6321

Related

Microsoft Update Tuesday November 2014: Fixes for 3 0-day Vulnerabilities Cyber Risks ·

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026

U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026