Security Update for Microsoft Windows DNS to Address Remote Code Execution | Hacker News Reader

Security Update for Microsoft Windows DNS to Address Remote Code Execution

technet.microsoft.com

37 pointschoult11 comments

Before we all freak out, this affects Windows DNS servers. Those are relatively rare, and are (hopefully) well maintained with patches, especially today which is the second Tuesday of the month. Nothing in the advisory suggests it affects normal Windows desktops.

Aren't domain controllers likely to run DNS services?

Very likely, but also typically not exposed to the internet. So there's definitely plenty of risk here, but an adversary would likely have to be within your network to query your DC.

“Within your network” could include anything from “using the guest wifi” to “got someone with an account to click on the wrong link / look at the wrong media file”.

Yes, it's not a worm. That doesn't mean it's not a big deal for a lot of people, particularly if they've already had a minor compromise by someone waiting for this kind of exploit to escalate.

And that's assuming you can't exploit it by controlling an upstream/authoritative nameserver or via DNS poisoning.

Agreed.

I will say Windows DNS servers are much more common on LANs, since they're a core part of Active Directory. But on the internet, I'd agree they're uncommon.

This affects 2008 and newer, older versions did not support DNAME[1] records. It isn't clear whether an existing DNAME record needs to exist in order for this to be exploitable. Skimming the Sonar FDNS[2] dataset, only 5,581 DNAME records were identified[3]. A diff has been posted by Greg Linares[4], showing the addition of a memset(0) to the DNAME merge function.

1. https://tools.ietf.org/html/rfc6672 2. https://scans.io/study/sonar.fdns 3. https://hdm.io/data/20151121_dname.txt.gz 4. https://twitter.com/Laughing_Mantis/status/67430845437942579...

It looks like there are multiple UAF patches (of which DNAME is one). The bigger problem appears to be the UAF in Recurse_ProcessResponse[0], which implies it may be more than just DNAME records.

[0] - https://twitter.com/Laughing_Mantis/status/67429469573696716...

The older versions are out of support though, aren't they? It's possible that variants of this might exist in those too if the sibling comment is correct.

Yes, but there's only so much anyone can reasonably be expected to do if someone doesn't update their computer for 7 years, I suppose.

This one would have been really fun if it was on the client resolver.

Reply on news.ycombinator.com