The malicious DNS query would ultimately allow the attacker to remotely execute code of their choice with SYSTEM level privileges without the need to authenticate to the server. The request would be crafted in such a way that it would trigger a heap-based integer buffer overflow within the DNS server executable the DNS client is not affected by this vulnerability. And while hacking DNS is bad enough, the common practice of running DNS from domain controllers could amplify the impact of this flaw, putting entire Active Directory environments at risk and consequently every network resource accessible via AD.Īs Check Point explained, an attacker could use a phishing email to link to an exploit that would send a large TCP DNS request to an unpatched server over port 53. Present in Windows Server since 2003, the vulnerability can be remotely exploited to grant an attacker Local SYSTEM privileges on the DNS server. SIGRed, a critical bug ( CVE-2020-1350) in Windows DNS servers disclosed Tuesday by Check Point and patched by Microsoft, could be the next bug to be so-abused. You don’t need to look any further than WannaCry or NotPetya to understand the potential harm from a wormable Windows vulnerability. CVE-2020-1350 is a wormable bug in Windows DNS servers that threatens Active Directory domain controllers and network resources.
0 kommentar(er)
