4 ms·
Security Update for Microsoft Windows DNS to Address Remote Code Execution
- jimrandomh 11y agoBefore we all freak out, this affects Windows DNS servers. Those are relatively rare, and are (hopefully) well maintained with patches, especially today which is the second Tuesday of the month. Nothing in the advisory suggests it affects normal Windows desktops.
- 0x0 11y agoAren't domain controllers likely to run DNS services?
- madsushi 11y agoVery likely, but also typically not exposed to the internet. So there's definitely plenty of risk here, but an adversary would likely have to be within your network to query your DC.
- acdha 11y ago“Within your network” could include anything from “using the guest wifi” to “got someone with an account to click on the wrong link / look at the wrong media file”. Yes, it's not a worm. That doesn't mean it's not a big deal for a lot of people, particularly if they've already had a minor compromise by someone waiting for this kind of exploit to escalate.
- AnthonyMouse 11y agoAnd that's assuming you can't exploit it by controlling an upstream/authoritative nameserver or via DNS poisoning.
- Someone1234 11y agoAgreed. I will say Windows DNS servers are much more common on LANs, since they're a core part of Active Directory. But on the internet, I'd agree they're uncommon.
- c0nsumer 11y agoThis one would have been really fun if it was on the client resolver.
- hdmoore 11y agoThis affects 2008 and newer, older versions did not support DNAME[1] records. It isn't clear whether an existing DNAME record needs to exist in order for this to be exploitable. Skimming the Sonar FDNS[2] dataset, only 5,581 DNAME records were identified[3]. A diff has been posted by Greg Linares[4], showing the addition of a memset(0) to the DNAME merge function. 1. https://tools.ietf.org/html/rfc6672 https://tools.ietf.org/html/rfc6672 2. https://scans.io/study/sonar.fdns https://scans.io/study/sonar.fdns 3. https://hdm.io/data/20151121_dname.txt.gz https://hdm.io/data/20151121_dname.txt.gz 4. https://twitter.com/Laughing_Mantis/status/674308454379425792 https://twitter.com/Laughing_Mantis/status/67430845437942579...
- dsp1234 11y agoIt looks like there are multiple UAF patches (of which DNAME is one). The bigger problem appears to be the UAF in Recurse_ProcessResponse[0], which implies it may be more than just DNAME records. [0] - https://twitter.com/Laughing_Mantis/status/674294695736967169 https://twitter.com/Laughing_Mantis/status/67429469573696716...
- rb12345 11y agoThe older versions are out of support though, aren't they? It's possible that variants of this might exist in those too if the sibling comment is correct.
- KirinDave 11y agoYes, but there's only so much anyone can reasonably be expected to do if someone doesn't update their computer for 7 years, I suppose.