Check Point identifies critical vulnerability in Windows DNS: says that immediate action is needed
- Published: Wednesday, 15 July 2020 07:25
Researchers at Check Point have identified a security flaw in Windows DNS, the domain name system (DNS) services provided by Microsoft in Windows operating systems. Hackers could use this vulnerability to gain Domain Administrator rights over servers, and seize control of organizational networks.
Sagi Tzaik, a vulnerability researcher at Check Point, discovered the security flaw, which could enable a hacker to craft malicious DNS queries to Windows DNS servers, and achieve arbitrary code execution that could lead to the breach of the entire infrastructure. The critical vulnerability, named SigRed by Check Point researchers, affects all Windows server versions from 2003 – 2019.
The flaw is in the way the Windows DNS server parses an incoming DNS query, and in the way it parses a response to a forwarded DNS query. If triggered by a malicious DNS query it triggers a heap-based buffer overflow, enabling the hacker to take control of the server and making it possible for them to intercept and manipulate users’ emails and network traffic, make services unavailable, harvest users’ credentials; and more.
Microsoft is expected to describe the vulnerability as ‘wormable,’ meaning that a single exploit can start a chain reaction that allows attacks to spread across vulnerable machines without requiring any human interaction. A single compromised machine could be a ‘super spreader,’ enabling the attack to spread throughout an organization’s network within minutes of the first exploit.
A patch for the vulnerability became available from Microsoft on July 14th 2020 and Check Point strongly urges Windows users to patch their affected Windows DNS Servers in order to prevent the exploitation of this vulnerability. Check Point believes that the likelihood of this vulnerability being exploited is high, as it internally found all of the primitives required to exploit this bug, which means a determined hacker could also find the same resources.
Omri Herscovici, Check Point’s Vulnerability Research Team Leader said: “A DNS server breach is a critical issue. Most of the time, it puts the attacker just one inch away from breaching the entire organization. There are only a handful of these vulnerability types ever released. Every organization, big or small using Microsoft infrastructure is at major security risk if this flaw is left unpatched. The risk would be a complete breach of the entire corporate network. This vulnerability has been in Microsoft code for more than 17 years, so if we found it, it is not impossible to assume that someone else already found it as well.
“Furthermore, our findings show us all that no matter how secure we think we are, there are always more security issues out there waiting to be discovered. We’re calling the vulnerability ‘SigRed’, and we believe it should be top priority for remedying. This isn’t just another vulnerability – patch now to stop the next cyber pandemic.”
On May 19th, 2020, Check Point Research responsibly disclosed its findings to Microsoft. Microsoft has assigning the vulnerability with the highest risk score possible (CVSS:10.0).
Check Point recommends the following protective actions:
- Apply the patch that Microsoft made available on July 14th 2020.
- Use a third party vendor to protect your corporate IT infrastructure
- Use the following workaround to block the attack: In “CMD” type: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v "TcpReceivePacketSize" /t REG_DWORD /d 0xFF00 /f net stop DNS && net start DNS