Researchers disclose a 17-year-old wormable flaw in Windows DNS servers. Organizations are strongly encouraged to apply patches as soon as possible. Update July 17, 2020: The Proof of Concept and Solutions sections have been updated to reflect the availability of proof of concept scripts and the availability of an audit file for Tenable products.

CVE-2020-1350: Wormable Remote Code Execution Vulnerability in Windows DNS Server Disclosed (SIGRed)

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

The remote Windows host is missing a security update. It is, therefore, affected by a remote code execution vulnerability:

  - A remote code execution vulnerability exists in Windows     Domain Name System servers when they fail to properly     handle requests. An attacker who successfully exploited     the vulnerability could run arbitrary code in the     context of the Local System Account. Windows servers     that are configured as DNS servers are at risk from this     vulnerability.  (CVE-2020-1350)

Note: Tenable is testing for the presence of updates which address this issue, as well as Microsoft's recommended mitigation/workaround.

The registry key being checked for the mitigation is:
  - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\TcpReceivePacketSize and it is being checked for Microsoft's recommended value of 0xFF00.

Once in place, the DNS Service must be restarted for the change to take effect.

For more information, refer to the Microsoft advisory for CVE-2020-1350.

According to its self-reported version number, the Microsoft DNS Server running on the remote host is affected by a remote code execution vulnerability. An unauthenticated, remote attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account.

Note that in order to get the full Microsoft DNS server version, the EnableVersionQuery DNS setting would need to be set to 1.

ID	Name	Product	Family	Severity
138600	Windows DNS Server RCE (CVE-2020-1350)	Nessus	Windows : Microsoft Bulletins	critical
138554	Microsoft DNS Server Remote Code Execution (SIGRed)	Nessus	DNS	critical

Detections

Analytics

CVE-2020-1350

critical

Tenable Plugins

critical

critical