SigRed Critical Wormable RCE Vulnerability in Windows DNS Servers – CVE-2020-1350

If you have Windows DNS server you need to patch ASAP

• 17-Year-Old Critical ‘Wormable’ RCE Vulnerability Impacts Windows DNS Servers
• Severity score of 10 out of 10 on the CVSS scale
• Affecting Windows Server versions 2003 to 2019
• CVE-2020-1350,
•Ddubbed ‘SigRed

Risk:
It could allow an unauthenticated, remote attacker to gain domain administrator privileges over targeted servers and seize complete control of an organization’s IT infrastructure.

The flaw is wormable in nature, allowing attackers to launch an attack that can spread from one vulnerable computer to another without any human interaction.

It’s possible that a single exploit can start a chain reaction that allows attacks to spread from vulnerable machine to vulnerable machine without requiring any human interaction,

Impact:
A threat actor can exploit SigRed vulnerability by sending crafted malicious DNS queries to a Windows DNS server and achieve arbitrary code execution, enabling the hacker to intercept and manipulate users’ emails and network traffic, make services unavailable, harvest users’ credentials and much more.

Fix/Solution:

Workaround:

If applying the patches is not possible, Microsoft has provided a workaround via a Windows registry modification:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
DWORD = TcpReceivePacketSize
Value = 0xFF00

In order for these changes to take effect, the DNS Service must be restarted.
Microsoft recommends removing the workaround after the patches have been applied.