Categories: Microsoft

Microsoft Patches Critical Wormable 17-Year-old Windows DNS Server Flaw that Affects Windows Server Versions 2003 to 2019

Microsoft patched a critical 17-Year-old vulnerability with Windows DNS Server that can be triggered by an attacker with malicious DNS response.

The Windows DNS Server is an essential part of the Windows Domain environment and runs the DNS queries on Windows Server.

The vulnerability dubbed SIGRed (CVE-2020-1350) is wormable and it receives a CVSS base score 10/10, and it can be triggered by an attacker with malicious DNS response.

SIGRed (CVE-2020-1350)

The DNS security flaw in Windows DNS discovered by Check Point and reported to Microsoft back in May. Now patch available for supported versions of Windows Servers.

Researchers found a Heap-Based Integer Overflow “dns.exe!SigWireRead,” with the function that parses the SIG queries.

SIG “Signature record” is a DNS record type used in (RFC 2931) and TKEY (RFC 2930), from RFC 3755, RRSIG is designated as a replacement for SIG to use with DNSSEC.

“To summarize, by sending a DNS response that contains a large (bigger than 64KB) SIG record, we can cause a controlled heap-based buffer overflow of roughly 64KB over a small allocated buffer.”

To trigger the vulnerability researchers first tried by sending a 65,535 bytes DNS message, but found that a single DNS message limited to 512 bytes alone cannot trigger the vulnerability.

So to achieve the attack researchers used DNS name compression in DNS response to increasing the size of the allocation by a large amount.

Exploiting Remotely

The vulnerability can be triggered remotely through an HTTP payload, by “sending it to the target DNS server on port 53 causes the Windows DNS Server to interpret this payload as if it was a DNS query.”

With the popular servers such as Google Chrome and Mozilla Firefox does not allow DNS request over port 53, it would be exploited only with non-Chromium based browsers such as Internet Explorer and Microsoft Edge.

Microsoft manages both the DNS client and DNS server in two different modules, but the vulnerability resides only with the DNS server, as the client version not validate the Sig_RecordRead+D0.

The vulnerability is rated as highly-severe one and the chance for exploitation is high. Successful exploitation of this vulnerability would have a severe impact.

Users are recommended to patch their affected Windows DNS Servers to prevent the exploitation of this vulnerability.

As a temporary workaround, Check Point suggests setting the maximum length of a DNS message (over TCP) to 0xFF00, which should eliminate the vulnerability.

reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters” /v “TcpReceivePacketSize” /t REG_DWORD /d 0xFF00 /f
net stop DNS && net start DNS

Microsoft releases patches for the SIGRed vulnerability and advised users to patch for the vulnerability immediately. If you have auto updates enabled, then no user action required.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Microsoft Released Emergency Security Updates for Windows 10 to Fix Remote Code Execution Bugs

Microsoft Defender ATP Antivirus is now Available For Android Users in Public Preview

Microsoft Released a Largest-Ever Security Patch with the Fixes For 129 Vulnerabilities – Update Now

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Blue Yonder Ransomware Attack Impacts Starbucks & Multiple Supermarkets

A ransomware attack on Blue Yonder, a leading supply chain management software provider, has created…

39 minutes ago

Dell Wyse Management Suite Vulnerabilities Let Attackers Exploit Affected Systems Remotely

Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address…

1 hour ago

CISA Details Red Team Assessment Including TTPs & Network Defense

The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment…

1 hour ago

IBM Workload Scheduler Vulnerability Stores User Credentials in Plain Text

IBM has issued a security bulletin warning customers about a vulnerability in its Workload Scheduler…

2 hours ago

Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges

Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of…

2 hours ago

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

17 hours ago