Friday, March 29, 2024

Microsoft Patches Critical Wormable 17-Year-old Windows DNS Server Flaw that Affects Windows Server Versions 2003 to 2019

Microsoft patched a critical 17-Year-old vulnerability with Windows DNS Server that can be triggered by an attacker with malicious DNS response.

The Windows DNS Server is an essential part of the Windows Domain environment and runs the DNS queries on Windows Server.

The vulnerability dubbed SIGRed (CVE-2020-1350) is wormable and it receives a CVSS base score 10/10, and it can be triggered by an attacker with malicious DNS response.

SIGRed (CVE-2020-1350)

The DNS security flaw in Windows DNS discovered by Check Point and reported to Microsoft back in May. Now patch available for supported versions of Windows Servers.

Researchers found a Heap-Based Integer Overflow “dns.exe!SigWireRead,” with the function that parses the SIG queries.

SIG “Signature record” is a DNS record type used in (RFC 2931) and TKEY (RFC 2930), from RFC 3755, RRSIG is designated as a replacement for SIG to use with DNSSEC.

“To summarize, by sending a DNS response that contains a large (bigger than 64KB) SIG record, we can cause a controlled heap-based buffer overflow of roughly 64KB over a small allocated buffer.”

To trigger the vulnerability researchers first tried by sending a 65,535 bytes DNS message, but found that a single DNS message limited to 512 bytes alone cannot trigger the vulnerability.

So to achieve the attack researchers used DNS name compression in DNS response to increasing the size of the allocation by a large amount.

Exploiting Remotely

The vulnerability can be triggered remotely through an HTTP payload, by “sending it to the target DNS server on port 53 causes the Windows DNS Server to interpret this payload as if it was a DNS query.”

With the popular servers such as Google Chrome and Mozilla Firefox does not allow DNS request over port 53, it would be exploited only with non-Chromium based browsers such as Internet Explorer and Microsoft Edge.

Microsoft manages both the DNS client and DNS server in two different modules, but the vulnerability resides only with the DNS server, as the client version not validate the Sig_RecordRead+D0.

The vulnerability is rated as highly-severe one and the chance for exploitation is high. Successful exploitation of this vulnerability would have a severe impact.

Users are recommended to patch their affected Windows DNS Servers to prevent the exploitation of this vulnerability.

As a temporary workaround, Check Point suggests setting the maximum length of a DNS message (over TCP) to 0xFF00, which should eliminate the vulnerability.

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters” /v “TcpReceivePacketSize” /t REG_DWORD /d 0xFF00 /f
net stop DNS && net start DNS

Microsoft releases patches for the SIGRed vulnerability and advised users to patch for the vulnerability immediately. If you have auto updates enabled, then no user action required.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Microsoft Released Emergency Security Updates for Windows 10 to Fix Remote Code Execution Bugs

Microsoft Defender ATP Antivirus is now Available For Android Users in Public Preview

Microsoft Released a Largest-Ever Security Patch with the Fixes For 129 Vulnerabilities – Update Now

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles