A vulnerability called SigRed, which can affect Microsoft Windows Server, has been discovered to have existed in the code for 17 years.
The vulnerability has been rated CVSS 10.0, and security researchers advise organizations to update their systems immediately.
Discovered by researcher Sagi Tzaik of Check Point and affects Microsoft Windows DNS and Server software.
According to the researchers, the vulnerability is particularly critical as it has the ability to self-propagate, and is thus able to jump to vulnerable machines without any interaction with the user and put all computers on a network at risk
By exploiting the flaw, "a hacker can craft malicious DNS requests to Windows and achieve arbitrary code execution that could lead to a compromise of the entire infrastructure," the team says.
SigRed affects all versions of Windows Server from 2003 to 2019.
The vulnerability is located in the way the Windows DNS Server parses an incoming DNS request, as well as how DNS requests are handled. Specifically, sending a DNS request with a SIG record over 64KB can “trigger a heap-based buffer overflow of about 64KB in a small allocated buffer”, the team says.
As the service runs with elevated privileges, if an attacker manages to exploit it, they also gain administrator privileges. More rarely, the vulnerability can also be triggered remotely, via browser sessions.
Check Point disclosed its findings to Microsoft on May 19. Microsoft has issued an update that fixes the vulnerability.
Although the company states that it has not discovered any exploitation of the vulnerability by malicious actors, the fact remains that it existed in its systems for a full 17 years. Therefore, it is very difficult to say with certainty that it has not been exploited at times by hackers.
