SIGRed

aka Windows DNS Server RCE

Product: Microsoft Windows DNS Server
CVE: CVE-2020-1350
Disclosed: 2020-07-14
CVSS: 10
Auth: pre-auth
CISA KEV: yes
Affected: Windows Server 2003 through Server 2019 (and SAC builds 1903-2004) running the DNS Server role.
Fixed: July 2020 Patch Tuesday updates.

Summary

A 17-year-old wormable bug in the Windows DNS Server found by Check Point. A malicious DNS response with an oversized SIG record overflows a heap buffer in dns.exe, which runs as SYSTEM and usually lives on domain controllers.

Root cause

dns.exe's SigWireRead function computes the size of a cached SIG resource record as a 16-bit integer. A response longer than 64KB (deliverable over TCP, and triggerable through a forwarded query to an attacker's domain) wraps the allocation size, causing a heap-based buffer overflow when the record is copied.

Impact

Unauthenticated SYSTEM RCE on Windows DNS servers, often domain controllers, which means full domain compromise; wormable.

Public PoC

# On a host that is the authoritative nameserver for your domain
# (listens on TCP+UDP 53 and serves the oversized SIG response)
python sigred_dos.py evil.example

# Make the target Windows DNS server resolve a SIG record for it
# (the '9' subdomain is required)
nslookup -type=sig 9.evil.example 10.0.0.53

Source: maxpl0it - CVE-2020-1350-DoS

Detection

Look for DNS responses over TCP larger than 65,280 bytes and SIG (type 24) records in responses; check July 2020 patch level. Suricata/Snort signatures were published by Check Point and others.

Mitigation

Patch. Workaround: set HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\TcpReceivePacketSize to 0xFF00 and restart the DNS service.