ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
CyberScooppublished ()ingested @shanvav

Microsoft issues patch for wormable Windows DNS Server flaw

criticalVulnerabilityimportance 60CVE-2020-1350
Read the original
Tagscve-2020-1350vulnerability

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2020-1350
Wormable Unauthenticated RCE in Microsoft Windows DNS Server

CVE-2020-1350 is a critical (CVSS 10.0) remote code execution vulnerability in the DNS Server role of Microsoft Windows Server, caused by improper input handling (CWE-20) when the server fails to properly process crafted DNS requests, notably malicious DNS signature (SIG) records delivered over TCP. An unauthenticated attacker can trigger it by sending a crafted DNS query that forces the vulnerable DNS server to perform an upstream lookup and receive a malicious response, overflowing a heap buffer. Successful exploitation yields code execution with SYSTEM privileges on the DNS server, which is very often an Active Directory domain controller, giving the attacker control of the host and typically the entire domain; the flaw is considered wormable because compromised DNS servers can propagate attacks to other servers they query. Any Windows Server 2008, 2012, 2016, or 2019 host running the DNS Server role is affected — internet-facing DNS servers are directly explovable, while internal DNS servers can be reached via malicious DNS responses passed through firewalls. The flaw was fixed in Microsoft's July 2020 updates, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, required action: apply vendor updates), carries EPSS of 91.4% (100th percentile), and appears in the NSA's top-25 list of flaws exploited by Chinese state-sponsored hackers; no public PoC is cataloged in this dataset and ransomware use is listed as unknown.

Do: Apply the July 2020 (or later) Microsoft security updates for each affected Windows Server release, prioritizing internet-facing DNS servers and domain controllers; if patching must be delayed, apply Microsoft's registry-based workaround limiting TCP DNS packet size (TcpReceivePacketSize = 0xFF00) and restart the DNS Server service. Inventory hosts with the DNS Server role installed and review their TCP/53 exposure, especially any resolvers reachable from the internet, and confirm remediation per CISA's required action.

10.091% KEV
  • microsoft windows server 2008 All builds with the DNS Server role enabled, prior to the July 2020 security updates
  • microsoft windows server 2012 All builds with the DNS Server role enabled, prior to the July 2020 security updates
  • microsoft windows server 2016 All builds with the DNS Server role enabled, prior to the July 2020 security updates
  • +1 more
masshundreds of thousands of internet-exposed Windows DNS servers (est.), with millions of total deployments including internal domain controllers
Full article678 words · extracted from cyberscoop.com · click to collapse
Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

Microsoft is issuing a patch for a severe Windows DNS vulnerability that could allow attackers to gain control of targets' entire IT infrastructure.

(raymondclarkeimages / Flickr)

Microsoft is issuing a patch for a severe and wormable Windows Domain Name System Server vulnerability that could allow attackers to execute arbitrary code against targets and gain control of targets’ entire IT infrastructure.

The vulnerability, which was uncovered by a researcher at Check Point, would allow hackers to intercept and interfere with users’ emails and network traffic, tamper with services, and steal users’ credentials, by exploiting Windows’ Domain Name System (DNS) Server; DNS is essentially the protocol that translates between website names and their corresponding IP addresses.

The vulnerability can be triggered by a malicious DNS response, which could lead to a heap-based buffer overflow, according to Check Point. The vulnerability, which Check Point has dubbed SigRed, is widespread as it affects all Windows Server versions, according to Microsoft.

It’s the third serious vulnerability Microsoft has addressed just this month, following the emergency disclosure and patching of two critical vulnerabilities affecting Windows 10 and Windows Server distributions. Those disclosures were so important to address in a timely manner that the company made the decision to release patches outside of Patch Tuesday.

Microsoft has assigned the vulnerability, CVE-2020-1350, the highest possible risk score of 10 on the Common Vulnerability Scoring System. Wormable flaws can be particularly menacing as attacks exploiting them can spread from machine to machine without any human interaction. The WannaCry ransomware strain, which affected 300,000 machines in hundreds of countries in 2017, for instance, was wormable.

Microsoft said it has not seen hackers exploiting the vulnerability. But the vulnerability will be important to patch for governments and private entities alike. Hackers have seized on DNS-related hacking operations in recent years to target intelligence agencies, military organizations, energy firms, foreign ministries, and telecommunications firms to steal credentials, according to security researchers. During the pandemic hackers have taken advantage of DNS to target home routers as teleworking surged around the globe.

Check Point’s vulnerability research team leader, Omri Herscovici, said in a statement the flaw could allow hackers to essentially gain control of an entire organization, warning that it’s possible other researchers or nefarious actors asides from Check Point could have learned of this vulnerability years ago and exploited it.

“A DNS server breach is a very serious thing. Most of the time, it puts the attacker just one inch away from breaching the entire organization,” Herscovici said. “This vulnerability has been in Microsoft code for more than 17 years; so if we found it, it is not impossible to assume that someone else already found it as well.”

Sagi Tzaik, a vulnerability researcher at Check Point, uncovered the vulnerability and shared the information with Microsoft in May, Check Point said in a release.

Latest Podcasts

Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/microsoft-dns-patch-check-point-july-2020/