13 ms·

Emergency Directive 20-03 – Remote code execution vulnerability in Windows DNS

102 points by PatrolX 6y ago

PatrolX 6y ago
Cybersecurity and Infrastructure Security Agency Report (PDF) : https://cyber.dhs.gov/assets/report/ed-20-03.pdf https://cyber.dhs.gov/assets/report/ed-20-03.pdf
rsync 6y ago
This isn't snark - I am serious. Who would be running a DNS server on a Windows system ? Why would they be doing such a thing ? What is the thinking here ? I understand running windows-specific infrastructure like an AD server or a PDC or whatever but ... a DNS server ?
- fowl2 6y ago
  AD has a very significant DNS component. All domain controllers are also dns servers.
  - vermilingua 6y ago
    All primary domain controllers are also DNS servers.
    - berbec 6y ago
      And extras are as well
    - EvanAnderson 6y ago
      There are no "primary domain controllers" in Active Directory. It's multimaster. There is one "primary domain controller emulator" in each domain that-- erm-- emulates an NT 4.0 primary domain controller-- but that's it.
      - sk5t 6y ago
        Plus the other FSMO roles... and some things only work with the PDCe... and some DCs can be RODCs...
  - jlgaddis 6y ago
    Perhaps more correctly, all domain controllers can optionally be DNS servers as well. Even when first setting up a new forest and new domain for the first time, installing a Microsoft DNS server is not required.
- kerng 6y ago
  My knowledge with Windows is a few years outdated but the way I recall it is that basically every DC by default is a DNS server (or at least the first DC that gets created) - because you need a name service if you want a useful Intranet. So every company that has AD probably has a Windows DNS server - which is kind of like every bigger company. Hope someone can confirm or dispute my info with 2020 hands-on experience.
  - moduspol 6y ago
    Yep. Most of the small companies I've seen just use the Windows DNS servers because they need them for AD. You can set up separate DNS servers and delegate AD's domain to the domain controllers, but then you're maintaining additional DNS servers. And besides, most of the small companies I've seen vastly prefer a Windows GUI than (e.g.) configuring bind on the command line.
- tenebrisalietum 6y ago
  Most AD infrastructures, e.g. SRV records. It's used for domain discovery, service discovery, optionally registering computer hostnames to DNS as part of IPAM/Microsoft DHCP server, and probably other things. Not an Exchange admin but I'm sure Exchange uses it.
  - jlgaddis 6y ago
    SRV records are part of the DNS standards and supported by pretty much every DNS server in existence. While properly functioning Active Directory and Exchange deployments both require SRV RRs, they certainly aren't Exchange- or Windows-specific.
  - Spooky23 6y ago
    It’s just easy to do, that’s it. It was a little difficult to run another DNS server with Windows 2000.... but that was a very long time ago. Even if you use MS DNS, it’s smart to run DNS on dedicated devices.
- 1MachineElf 6y ago
  Yeah, it's a highly integrated piece of Microsoft Active Directory, which is a core piece of any "Enterprise" Windows deployment. It's not just something that stays on internal networks - organizations that have trusts between their Active Directory systems have connections too. But for public networks, I completely agree that it's insanity to run DNS on Windows.
  - jiggawatts 6y ago
    Why? It works quite well! I just recently worked on a large government department that had approximately 100 public, Internet-facing DNS zones hosted on a pair of Windows servers. I seriously don't get this automatic dismissal of Windows Server as "not a real server operating system". An enormous fraction of large enterprises run on it, very often for Internet-facing infrastructure. Microsoft.com. Azure.net. Stackoverflow.com. You know... those teeny-tiny toy sites nobody ever visits. Just because you're not familiar with it, and just because you can't imagine how it could be managed properly doesn't mean other people don't know how to do it. PS: The list of BIND's CVE entries is here, in case you think that being UNIX-based makes it magically immune to security vulnerabilities: https://www.cvedetails.com/vulnerability-list.php?vendor_id=64&product_id=144 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
    - lmm 6y ago
      If it's not open-source, then how can you be confident that it doesn't suck? Hobbyists don't tinker with it, people probably don't publish benchmarks of it. Sure, maybe it works fine, but it might also be awful. So why take the risk when there's an open-source option?
      - jodrellblank 6y ago
        "Ninety per cent of Fortune 500 companies use Azure AD, the sign-in engine for Office 365." - https://azure.microsoft.com/en-gb/services/active-directory/integrate/#features https://azure.microsoft.com/en-gb/services/active-directory/... But you can't know whether it works unless hobbyists tinker with it?? (Even though hobbyists do tinker with Windows)
- jlgaddis 6y ago
  You do understand that the corporate world runs on Microsoft Windows and Active Directory, right? DNS is an absolutely critical component of Active Directory (there's even an old joke that, when dealing with Active Directory issues, "it's always DNS"). In an AD environment, clients are almost always configured to use Windows DNS servers as their DNS servers, with the Windows DNS servers then performing forwarding (of any unanswerable queries) on their behalf. This way is, by far, a helluva lot easier. You could have non-Microsoft DNS servers that slave the zones from the Windows DNS servers and point the clients at those. You can even go a step further and avoid using Microsoft DNS entirely. Despite what some people (even some here, apparently), you absolutely CAN run Active Directory without using Microsoft DNS at all (although there are several advantages to using Microsoft DNS)! BIND, for instance, can be used instead of Microsoft DNS. It completely supports all the features that are needed for Active Directory -- in fact, it provides a number of additional features that are often "nice to have" as well. Because it is a PITA to set up and support, though, these type of deployments are fairly uncommon. In most cases, it's much "easier" to just use Microsoft DNS (which can be installed and set up for you automatically when first deploying Active Directory) -- especially when the folks managing Active Directory don't really have a great understanding of DNS itself. For example, I imagine the average Windows administrator would be completely dumbfounded if you asked them to hand-edit a BIND zone file! Instead, with Microsoft DNS, they can just point and click their way around. This, of course, leaves out all discussion of DHCP which (in a corporate Windows environment) is pretty much always required as well. Running all of this on Windows means you don't have to deal with integrating all of the various pieces yourself.
  - EvanAnderson 6y ago
    A "win" w/ Active Directory-based DNS servers (and storing the DNS records within Active Directory) is that you get replication between the DNS servers by way of AD replication "for free". There's a certain component of "snake eating its own tail" to it, insofar as you have to bootstrap new Domain Controller computers by having them use another DNS server while they pull their initial replica. Active Directory-integrated DNS gets you per-record ACLs to authenticate dynamic updates, too.
    - 6y ago
- badrabbit 6y ago
  Like others said, every corporate windows network uses windows domain controllers as primary DNS resolvers. I wanted to add that, as computers are added to AD, you get a PTR record automatically in windows. If you have even a medium size network where new computers get added all the time, it would be a pain to autocreate their PTR records in bind. Also, for forwarders, I've seen DC's do full on recursive resolution themselves but when you need a forwarder you would ideally use a commercial solution that probably uses bind internally instead of rolling your own Linux bind server(typically)
  - jlgaddis 6y ago
    > ... as computers are added to AD, you get a PTR record automatically in windows. This is, of course, configurable and can be turned on or off. > ... it would be a pain to autocreate their PTR records in bind. Yes, it would. Fortunately, ISC DHCP and BIND, for example, can also handle this automatically.
- jeppesen-io 6y ago
  What others have said but also keep in mind many corporate environments have been running windows dns for nearly 20 years. DNS migrations from windows take years. So many subtle changes, delegations, forwarding etc etc. Windows DNS isn't the best but it's reliable and gets the job done. Plus, quick and easy dynamic DNS entries from windows servers or workstations using AD computer account auth
- whatsmyusername 6y ago
  DNS is a core service in Active Directory. It’s used for major service discovery. Hosts will also auto register themselves if you want that. You don’t have to run it as your primary DNS server but it at least has to be delegated for your AD subdomain.
Neil44 6y ago
Even if your Windows DNS is not exposed to the internet, it means that anyone getting a device on your WAN can get windows domain admin.

102 points by PatrolX 6y ago

Cybersecurity and Infrastructure Security Agency Report (PDF) : https://cyber.dhs.gov/assets/report/ed-20-03.pdf https://cyber.dhs.gov/assets/report/ed-20-03.pdf

rsync 6y ago

This isn't snark - I am serious. Who would be running a DNS server on a Windows system ? Why would they be doing such a thing ? What is the thinking here ? I understand running windows-specific infrastructure like an AD server or a PDC or whatever but ... a DNS server ?

fowl2 6y ago
AD has a very significant DNS component. All domain controllers are also dns servers.
- vermilingua 6y ago
  All primary domain controllers are also DNS servers.
  - berbec 6y ago
    And extras are as well
  - EvanAnderson 6y ago
    There are no "primary domain controllers" in Active Directory. It's multimaster. There is one "primary domain controller emulator" in each domain that-- erm-- emulates an NT 4.0 primary domain controller-- but that's it.
    - sk5t 6y ago
      Plus the other FSMO roles... and some things only work with the PDCe... and some DCs can be RODCs...
- jlgaddis 6y ago
  Perhaps more correctly, all domain controllers can optionally be DNS servers as well. Even when first setting up a new forest and new domain for the first time, installing a Microsoft DNS server is not required.
kerng 6y ago
My knowledge with Windows is a few years outdated but the way I recall it is that basically every DC by default is a DNS server (or at least the first DC that gets created) - because you need a name service if you want a useful Intranet. So every company that has AD probably has a Windows DNS server - which is kind of like every bigger company. Hope someone can confirm or dispute my info with 2020 hands-on experience.
- moduspol 6y ago
  Yep. Most of the small companies I've seen just use the Windows DNS servers because they need them for AD. You can set up separate DNS servers and delegate AD's domain to the domain controllers, but then you're maintaining additional DNS servers. And besides, most of the small companies I've seen vastly prefer a Windows GUI than (e.g.) configuring bind on the command line.
tenebrisalietum 6y ago
Most AD infrastructures, e.g. SRV records. It's used for domain discovery, service discovery, optionally registering computer hostnames to DNS as part of IPAM/Microsoft DHCP server, and probably other things. Not an Exchange admin but I'm sure Exchange uses it.
- jlgaddis 6y ago
  SRV records are part of the DNS standards and supported by pretty much every DNS server in existence. While properly functioning Active Directory and Exchange deployments both require SRV RRs, they certainly aren't Exchange- or Windows-specific.
- Spooky23 6y ago
  It’s just easy to do, that’s it. It was a little difficult to run another DNS server with Windows 2000.... but that was a very long time ago. Even if you use MS DNS, it’s smart to run DNS on dedicated devices.
1MachineElf 6y ago
Yeah, it's a highly integrated piece of Microsoft Active Directory, which is a core piece of any "Enterprise" Windows deployment. It's not just something that stays on internal networks - organizations that have trusts between their Active Directory systems have connections too. But for public networks, I completely agree that it's insanity to run DNS on Windows.
- jiggawatts 6y ago
  Why? It works quite well! I just recently worked on a large government department that had approximately 100 public, Internet-facing DNS zones hosted on a pair of Windows servers. I seriously don't get this automatic dismissal of Windows Server as "not a real server operating system". An enormous fraction of large enterprises run on it, very often for Internet-facing infrastructure. Microsoft.com. Azure.net. Stackoverflow.com. You know... those teeny-tiny toy sites nobody ever visits. Just because you're not familiar with it, and just because you can't imagine how it could be managed properly doesn't mean other people don't know how to do it. PS: The list of BIND's CVE entries is here, in case you think that being UNIX-based makes it magically immune to security vulnerabilities: https://www.cvedetails.com/vulnerability-list.php?vendor_id=64&product_id=144 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
  - lmm 6y ago
    If it's not open-source, then how can you be confident that it doesn't suck? Hobbyists don't tinker with it, people probably don't publish benchmarks of it. Sure, maybe it works fine, but it might also be awful. So why take the risk when there's an open-source option?
    - jodrellblank 6y ago
      "Ninety per cent of Fortune 500 companies use Azure AD, the sign-in engine for Office 365." - https://azure.microsoft.com/en-gb/services/active-directory/integrate/#features https://azure.microsoft.com/en-gb/services/active-directory/... But you can't know whether it works unless hobbyists tinker with it?? (Even though hobbyists do tinker with Windows)
jlgaddis 6y ago
You do understand that the corporate world runs on Microsoft Windows and Active Directory, right? DNS is an absolutely critical component of Active Directory (there's even an old joke that, when dealing with Active Directory issues, "it's always DNS"). In an AD environment, clients are almost always configured to use Windows DNS servers as their DNS servers, with the Windows DNS servers then performing forwarding (of any unanswerable queries) on their behalf. This way is, by far, a helluva lot easier. You could have non-Microsoft DNS servers that slave the zones from the Windows DNS servers and point the clients at those. You can even go a step further and avoid using Microsoft DNS entirely. Despite what some people (even some here, apparently), you absolutely CAN run Active Directory without using Microsoft DNS at all (although there are several advantages to using Microsoft DNS)! BIND, for instance, can be used instead of Microsoft DNS. It completely supports all the features that are needed for Active Directory -- in fact, it provides a number of additional features that are often "nice to have" as well. Because it is a PITA to set up and support, though, these type of deployments are fairly uncommon. In most cases, it's much "easier" to just use Microsoft DNS (which can be installed and set up for you automatically when first deploying Active Directory) -- especially when the folks managing Active Directory don't really have a great understanding of DNS itself. For example, I imagine the average Windows administrator would be completely dumbfounded if you asked them to hand-edit a BIND zone file! Instead, with Microsoft DNS, they can just point and click their way around. This, of course, leaves out all discussion of DHCP which (in a corporate Windows environment) is pretty much always required as well. Running all of this on Windows means you don't have to deal with integrating all of the various pieces yourself.
- EvanAnderson 6y ago
  A "win" w/ Active Directory-based DNS servers (and storing the DNS records within Active Directory) is that you get replication between the DNS servers by way of AD replication "for free". There's a certain component of "snake eating its own tail" to it, insofar as you have to bootstrap new Domain Controller computers by having them use another DNS server while they pull their initial replica. Active Directory-integrated DNS gets you per-record ACLs to authenticate dynamic updates, too.
  - 6y ago
badrabbit 6y ago
Like others said, every corporate windows network uses windows domain controllers as primary DNS resolvers. I wanted to add that, as computers are added to AD, you get a PTR record automatically in windows. If you have even a medium size network where new computers get added all the time, it would be a pain to autocreate their PTR records in bind. Also, for forwarders, I've seen DC's do full on recursive resolution themselves but when you need a forwarder you would ideally use a commercial solution that probably uses bind internally instead of rolling your own Linux bind server(typically)
- jlgaddis 6y ago
  > ... as computers are added to AD, you get a PTR record automatically in windows. This is, of course, configurable and can be turned on or off. > ... it would be a pain to autocreate their PTR records in bind. Yes, it would. Fortunately, ISC DHCP and BIND, for example, can also handle this automatically.
jeppesen-io 6y ago
What others have said but also keep in mind many corporate environments have been running windows dns for nearly 20 years. DNS migrations from windows take years. So many subtle changes, delegations, forwarding etc etc. Windows DNS isn't the best but it's reliable and gets the job done. Plus, quick and easy dynamic DNS entries from windows servers or workstations using AD computer account auth
whatsmyusername 6y ago
DNS is a core service in Active Directory. It’s used for major service discovery. Hosts will also auto register themselves if you want that. You don’t have to run it as your primary DNS server but it at least has to be delegated for your AD subdomain.

Neil44 6y ago

Even if your Windows DNS is not exposed to the internet, it means that anyone getting a device on your WAN can get windows domain admin.