REMOTE code execution in windows (server) DNS server (how to patch)

[Ben Mitchell]

Over the last few hours, Microsoft has announced they have patched a remote code execution in the Windows (server) DNS server. (CVE-2020-1350).

 

There are already patches and workarounds, these need to be applied ASAP. You can find the article on the MSRC page here

 

TLDR;

 

If you cannot apply the patch you can quickly deploy a registry workaround which will mitigate the risk until you can fully patch it. 

 

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters 
  DWORD = TcpReceivePacketSize 
  Value = 0xFF00

NOTE: this requires a DNS service restart. 

 

Edit: Specify that it only affects the server variants.

 

Edit2:

 

Take this with a grain of salt but there seems to be someone claiming responsibility for it over on twitter.

Edited July 14, 2020 by Ben Mitchell
Specify that it is for server, also twitter link.

[Kilrah]

Should probably note that this is about Windows Server, irrelevant for most people here.