Microsoft Issues Guidance For DNS Cache Poisoning Vulnerability

Microsoft issued guidance on how to mitigate a DNS cache poisoning vulnerability reported by security researchers from the University of California and Tsinghua University.

Successfully exploiting the vulnerability could allow attackers to use modified DNS records to redirect a target to a malicious website under their control as part of DNS spoofing (also known as DNS cache poisoning) attacks.

The end goal of such attacks is to either exploit device or software vulnerabilities to infect the target with malware or to harvest sensitive information via a phishing landing page.

Impacts multiple Windows server platforms

The addressing spoofing vulnerability — tracked as CVE-2020-25705 and nicknamed SAD DNS (Side-channel AttackeD DNS) — exists in the Windows DNS Resolver software component that comes bundled with the Windows Transmission Control Protocol/Internet Protocol (TCP/IP) stack.

“Microsoft is aware of a vulnerability involving DNS cache poisoning caused by IP fragmentation that affects Windows DNS Resolver,” the company explains in a security advisory published as part of this month’s Patch Tuesday.

Also Read: Letter of Consent MOM: Getting the Details Right

“An attacker who successfully exploited this vulnerability could spoof the DNS packet which can be cached by the DNS Forwarder or the DNS Resolver.”

SAD DNS is rated by Microsoft as ‘Important’ severity and it impacts only Windows server platforms, between Windows Server 2008 R2 and Windows 10, version 20H2 (Server Core Installation).

CVE-2020-25705 mitigation

To mitigate this vulnerability, Windows administrators can alter the Registry to change the maximum UDP packet size to 1,221 bytes which would block any DNS cache poisoning attacks attempting to exploit it on vulnerable devices.

To do that, admins are required to go through the following procedure:

1. Run regedit.exe as Administrator.
2. In Registry Editor, navigate to the HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters subkey and set the following parameters:
   1. Value: MaximumUdpPacketSize
   2. Type: DWORD
   3. Data: 1221
3. Close Registry Editor and restart the DNS service.

After the registry update, the DNS resolver will now switch to TCP for all responses larger than 1,221 bytes, automatically blocking any CVE-2020-25705 attacks.

According to researchers who discovered SAD DNS, CVE-2020-25705 also impacts other operating systems besides Windows including Linux, macOS, and FreeBSD, as well as other DNS resolvers including but not limited to BIND, Unbound, and dnsmasq.

Microsoft has also released security updates today to fix  58 vulnerabilities as part of December 2020 Patch Tuesday, nine classified as Critical, 48 as Important, and two as Moderate severity.

Also Read: A Look at the Risk Assessment Form Singapore Government Requires