Tuesday, May 28, 2024

Microsoft Patches Critical Wormable 17-Year-old Windows DNS Server Flaw that Affects Windows Server Versions 2003 to 2019

Microsoft patched a critical 17-Year-old vulnerability with Windows DNS Server that can be triggered by an attacker with malicious DNS response.

The Windows DNS Server is an essential part of the Windows Domain environment and runs the DNS queries on Windows Server.

The vulnerability dubbed SIGRed (CVE-2020-1350) is wormable and it receives a CVSS base score 10/10, and it can be triggered by an attacker with malicious DNS response.

SIGRed (CVE-2020-1350)

The DNS security flaw in Windows DNS discovered by Check Point and reported to Microsoft back in May. Now patch available for supported versions of Windows Servers.

Researchers found a Heap-Based Integer Overflow “dns.exe!SigWireRead,” with the function that parses the SIG queries.

SIG “Signature record” is a DNS record type used in (RFC 2931) and TKEY (RFC 2930), from RFC 3755, RRSIG is designated as a replacement for SIG to use with DNSSEC.

“To summarize, by sending a DNS response that contains a large (bigger than 64KB) SIG record, we can cause a controlled heap-based buffer overflow of roughly 64KB over a small allocated buffer.”

To trigger the vulnerability researchers first tried by sending a 65,535 bytes DNS message, but found that a single DNS message limited to 512 bytes alone cannot trigger the vulnerability.

So to achieve the attack researchers used DNS name compression in DNS response to increasing the size of the allocation by a large amount.

Exploiting Remotely

The vulnerability can be triggered remotely through an HTTP payload, by “sending it to the target DNS server on port 53 causes the Windows DNS Server to interpret this payload as if it was a DNS query.”

With the popular servers such as Google Chrome and Mozilla Firefox does not allow DNS request over port 53, it would be exploited only with non-Chromium based browsers such as Internet Explorer and Microsoft Edge.

Microsoft manages both the DNS client and DNS server in two different modules, but the vulnerability resides only with the DNS server, as the client version not validate the Sig_RecordRead+D0.

The vulnerability is rated as highly-severe one and the chance for exploitation is high. Successful exploitation of this vulnerability would have a severe impact.

Users are recommended to patch their affected Windows DNS Servers to prevent the exploitation of this vulnerability.

As a temporary workaround, Check Point suggests setting the maximum length of a DNS message (over TCP) to 0xFF00, which should eliminate the vulnerability.

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters” /v “TcpReceivePacketSize” /t REG_DWORD /d 0xFF00 /f
net stop DNS && net start DNS

Microsoft releases patches for the SIGRed vulnerability and advised users to patch for the vulnerability immediately. If you have auto updates enabled, then no user action required.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Microsoft Released Emergency Security Updates for Windows 10 to Fix Remote Code Execution Bugs

Microsoft Defender ATP Antivirus is now Available For Android Users in Public Preview

Microsoft Released a Largest-Ever Security Patch with the Fixes For 129 Vulnerabilities – Update Now


Latest articles

Researchers Exploited Nexus Repository Using Directory Traversal Vulnerability

Hackers target and exploit GitHub repositories for a multitude of reasons and illicit purposes.The...

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles