A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability. To exploit the vulnerability, an unauthenticated attacker could send malicious requests to a Windows DNS server. The update addresses the vulnerability by modifying how Windows DNS servers handle requests.
This vulnerability has a CVSS Base score of 10. How bad is this? We consider this to be a wormable vulnerability, meaning that it has the potential to spread via malware between vulnerable computers without user interaction. DNS is a foundational networking component and commonly installed on Domain Controllers, so a compromise could lead to significant service interruptions and the compromise of high level domain accounts. Are any other non-Microsoft DNS server implementations impacted by this vulnerability? The vulnerability stems from a flaw in Microsoft’s DNS server implementation and is not the result of a protocol level flaw, so it does not affect any other non-Microsoft DNS server implementations. Under what circumstances would I consider using the registry key workaround? Microsoft recommends everyone who runs DNS servers to install the security update as soon as possible. However, if you are unable to apply the patch right away, Microsoft recommends that you use the workaround as soon as possible to protect your environment in the time before you install the updates. Is the Windows DNS client affected by this vulnerability? No, the vulnerability only affects Microsoft's Windows DNS Server implementation, so the Windows DNS client is not affected. Are internal, non-public facing DNS servers also vulnerable? Yes, Internally facing DNS servers are also affected because the vulnerability occurs when a server processes a maliciously crafted response and this can be triggered by any client name request. Are all Windows Servers affected by this vulnerability? No. Only Windows servers that are configured as DNS servers are affected by this vulnerability.
Maturity: Detection
Sagi Tzadik and Eyal Itkin from Check Point Research