Check Point
Researchers identified a security flaw in Windows DNS, the DNS services
provided by Microsoft for every Windows operating system. Hackers could exploit
vulnerability to gain Domain Administrator rights over servers to seize
complete control over a corporation’s IT
·Microsoft acknowledges issue, rating it with
highest security risk score possible (CVSS 10.0)
·Security flaw is “wormable”, meaning a single
exploit can cause a chain reaction that allows attacks to spread from one
computer to another
·Check Point urges Windows users everywhere to patch
in Microsoft’s upcoming “Patch Tuesday”
Researchers
at Check Point identified a security flaw in Windows DNS, the implementation of
domain name system (DNS) services provided by Microsoft in Windows operating
systems. Sagi Tzaik, a vulnerability researcher at Check Point, discovered a
security flaw that would enable a hacker to craft malicious DNS queries to the
Windows DNS server, and achieve arbitrary code execution that could lead to the
breach of the entire infrastructure. The critical vulnerability, named SigRed
by Check Point researchers, affects Windows server versions from 2003-2019.
DNS,
often referred to as the “phonebook of the internet”, is part of the global
internet infrastructure that translates the familiar website names that we all
use, into the strings of numbers that computers need in order to find that
website, or send an email. It’s the ‘address book’ of the internet. When you
have a domain name – for example, www.checkpoint.com – you control what
number that name resolves to via a ‘DNS record.’ These servers are present in
every organization, and If exploited, would give a hacker Domain
Administrator rights over the server, enabling the hacker to intercept and manipulate users’ emails and network
traffic, make services unavailable, harvest users’ credentials and more. In
effect, the hacker could seize complete control of a corporations IT.
Responsible Disclosure
On
May 19, 2020, Check Point Research responsibly disclosed its findings to
Microsoft. Microsoft acknowledged the security flaw and will be issuing a patch
(CVE-2020-1350) on its upcoming “Patch Tuesday” (July 14, 2020). Microsoft will
be assigning the vulnerability with the highest risk score possible
(CVSS:10.0).
Contagious Flaw
Microsoft
is set to describe the vulnerability as ‘wormable,’ meaning that a single
exploit can start a chain reaction that allows attacks to spread from
vulnerable machine to vulnerable machine without requiring any human
interaction. This means that a single compromised machine could be a
‘super spreader,’ enabling the attack to spread throughout an organization’s
network within minutes of the first exploit.
Patch Now!
The
patch for the vulnerability will be available July 14, 2020 and onward. Check
Point strongly urges Windows users to patch their affected Windows DNS Servers
in order to prevent the exploitation of this vulnerability. Check Point
believes that the likelihood of this vulnerability being exploited is high, as
we internally found all of the primitives required to exploit this bug, which means
a determined hacker could also find the same resources.
Quote: Omri Herscovici, Check Point’s Vulnerability Research Team
Leader:
“A
DNS server breach is a very serious thing. Most of the time, it puts the
attacker just one inch away from breaching the entire organization. There are
only a handful of these vulnerability types ever released. Every organization,
big or small using Microsoft infrastructure is at major security risk, if left
unpatched. The risk would be a complete breach of the entire corporate network.
This vulnerability has been in Microsoft code for more than 17 years; so if we
found it, it is not impossible to assume that someone else already found it as
well.
Furthermore,
our findings show us all that no matter how secure we think we are, there are
infinite amount of security issues out there waiting to be discovered. We’re
calling the vulnerability “SigRed”, and we believe it should be top priority
for remedying. This isn’t just another vulnerability – patch now to stop the
next cyber pandemic.”
How to Stay Protected
1.Apply the patch that Microsoft will make available
on Patch Tuesday (July 14, 2020)
2.Use a third party vendor to protect your corporate
IT infrastructure
3. Use the following workaround to block the
attack: In “CMD” type:
