Microsoft Fixes 17-Year-Old Wormable Flaw in Windows DNS Server
Microsoft addresses a critical, wormable remote code execution vulnerability in Windows DNS Server that attackers exploit through malicious DNS responses.
Microsoft releases an emergency security patch for a critical, wormable vulnerability in Windows DNS Server known as SIGRed (CVE-2020-1350). This flaw earns a maximum severity score of 10 out of 10 and affects Windows Server versions from 2003 to 2019. Because the bug is wormable, it spreads automatically across vulnerable networks without any user interaction, placing it in the same high-risk category as the infamous EternalBlue and BlueKeep exploits.
Check Point researchers discover that attackers trigger this remote code execution flaw by sending a specially crafted DNS response containing a SIG record larger than 64KB. When the Windows DNS Server forwards a query and receives this malicious response, an integer overflow causes a heap-based buffer overflow. This parsing error allows attackers to gain Domain Administrator privileges and completely compromise the underlying corporate infrastructure.
The existence of this bug goes unnoticed for almost 17 years, highlighting the hidden risks in legacy code. Microsoft strongly urges all system administrators to apply the security update immediately to prevent potential widespread network infections. Organizations also have the option to implement a temporary registry-based workaround to mitigate the threat while they schedule the necessary patch deployments.