Posted by Mumbai: A 17-year-old critical Windows DNS Server vulnerability detected recently has been patched. Microsoft on Tuesday released a security update for a critical RCE (Remote Code Execution) vulnerability found in Windows DNS Server identified as “wormable.”
“Wormable” a critical RCE ( Remote Code Execution) vulnerability emerged from a flaw in Microsoft’s DNS server role implementation and affects all Windows Server versions. But it doesn’t impact on non-Microsoft DNS servers, the company said.
“Wormable vulnerabilities have the potential to spread via malware between vulnerable computers without user interaction. Windows DNS Server is a core networking component,” said Mechele Gruhn, Principal Security PM Manager, MSRC.
Gruhn pointed out that this vulnerability is not known to be used in any active attack. But it is essential that customers apply Windows updates to address this vulnerability as soon as possible.
“If applying the update quickly is not practical, a registry-based workaround is available that does not require restarting the server. The update and the workaround are both detailed in CVE-2020-1350,” explained Gruhn.
Further, Gruhn added that customers with automatic updates turned on do not need to take any additional action.
Although, Microsoft has released an update against the vulnerability. Check Point Research that had found this security flaw in May 2020 and had informed Microsoft.
Sagi Tzaik, a vulnerability researcher at Check Point, discovered a security flaw that would enable a hacker to craft malicious DNS queries to the Windows DNS server, and achieve arbitrary code execution that could lead to the breach of the entire infrastructure.
Check Point Researchers named the critical vulnerability as SigRed, affects Windows server versions from 2003-2019.
“A DNS server breach is a very serious thing. Most of the time, it puts the attacker just one inch away from breaching the entire organization. There are only a handful of these vulnerability types ever released,” said Omri Herscovici, Check Point’s Vulnerability Research Team Leader.
“Every organization, big or small using Microsoft infrastructure is at major security risk, if left unpatched. The risk would be a complete breach of the entire corporate network,” warned Hersocovici.
“This vulnerability has been in Microsoft code for more than 17 years; so if we found it, it is not impossible to assume that someone else already found it as well,” stated Herscovici.
“Our findings show us all that no matter how secure we think we are, there are infinite amount of security issues out there waiting to be discovered,” commented Herscovici.
“We’re calling the vulnerability “SigRed”, and we believe it should be top priority for remedying. This isn’t just another vulnerability – patch now to stop the next cyber pandemic,” emphasized Herscovici.
DNS, often referred to as the “phonebook of the internet”, is part of the global internet infrastructure that translates the familiar website names that we all use, into the strings of numbers that computers need in order to find that website, or send an email. It’s the ‘address book’ of the internet.
When you have a domain name – for example, www.checkpoint.com – you control what number that name resolves to via a ‘DNS record.’
These servers are present in every organization, and if exploited, would give a hacker Domain Administrator rights over the server, enabling the hacker to intercept and manipulate users’ emails and network traffic, make services unavailable, harvest users’ credentials and more. In effect, the hacker could seize complete control of a corporations IT.
Responsible Disclosure
On May 19, 2020, Check Point Research responsibly disclosed its findings to Microsoft. Microsoft acknowledged the security flaw and will be issuing a patch (CVE-2020-1350) on its upcoming “Patch Tuesday” (July 14, 2020). Microsoft will be assigning the vulnerability with the highest risk score possible (CVSS:10.0).
Contagious Flaw
Microsoft identified the vulnerability as ‘wormable,’ meaning that a single exploit can start a chain reaction that allows attacks to spread from vulnerable machine to vulnerable machine without requiring any human interaction. This means that a single compromised machine could be a ‘super spreader,’ enabling the attack to spread throughout an organization’s network within minutes of the first exploit.
Patch Now!
The patch for the vulnerability will be available July 14, 2020 and onward. Check Point strongly urges Windows users to patch their affected Windows DNS Servers in order to prevent the exploitation of this vulnerability.
The likelihood of this vulnerability being exploited is high, according to the security company. It internally found that all of the primitives required to exploit this bug, which means a determined hacker could also find the same resources.
How to Stay Protected
- Apply the patch that Microsoft will make available on Patch Tuesday (July 14, 2020)
- Use a third party vendor to protect your corporate IT infrastructure
- Use the following workaround to block the attack: In “CMD” type: reg add “HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesDNSParameters” /v “TcpReceivePacketSize” /t REG_DWORD /d 0xFF00 /f net stop DNS && net start DNS