Microsoft urge users to patch against critical vulnerability
Author : Matt Yarranton
16 July 2020

Microsoft is warning of a recently discovered critical Windows DNS Server vulnerability that is described as “wormable”. DNS (Domain Name Services) is used by computers all over the world to find each other. The Internet could not work without it. Microsoft DNS is specifically used inside businesses all over the world and allows Windows systems to locate computers and services within the business network. If a business is running Windows desktops and servers, they are almost certainly using Microsoft DNS.

Such a flaw could allow attackers to create special malware that remotely executes a code on Windows servers and creates malicious DNS queries that could even eventually lead to a company’s entire network being compromised.

“Wormable vulnerabilities have the potential to spread via malware between vulnerable computers without user interaction,” “Windows DNS Server is a core networking component. While this vulnerability is not currently known to be used in active attacks, it is essential that customers apply Windows updates to address this vulnerability as soon as possible.” explained Mechele Gruhn,  a principal security program manager at Microsoft.

This vulnerability is as bad as it gets

If you want more detail of what a worm is, remember WannaCry?  This took advantage of the wormable EternalBlue exploit in Windows’ Server Message Block (SMB).   The Common Vulnerability Scoring System (CVSS), gave EternalBlue an 8.5/10 score for severity. If you want a comparison, this new DNS vulnerability has been allocated a severity score of 10/10.

In a blog post published Tuesday, Check Point described in detail how the bug works, and have named the flaw SIGRed, and also said it believes there’s a high chance of this vulnerability being exploited.

“Every organization, big or small using Microsoft infrastructure is at major security risk, if left unpatched. The risk would be a complete breach of the entire corporate network. This vulnerability has been in Microsoft code for more than 17 years; so if we found it, it is not impossible to assume that someone else already found it as well.”

Hard disks in an array lit by blue light

Patch as soon as possible

If you are a home user you needn’t worry as Windows 10 and other DNS client systems are not affected; this only affects Windows servers running DNS.  If you have Active Directory in your organisation, you will be running Microsoft DNS.

Microsoft has released a patch, and affected systems should have this applied as soon as possible.  If applying the update quickly is not practical, a registry-based workaround is available that does not require restarting the server. The update and the workaround are both detailed in CVE-2020-1350.

If you are not sure how this affects you, please get in touch with us. We can help.

More Content

Why now is a great time to start your own business

"I can accept failure, but I can't accept not trying." - Michael Jordan We are living in unprecedented times.  People are being prevented from leaving their homes and the average worker has been sent to work from home, put on reduced hours, or worse.  It is...

Anti-virus programs aren’t enough

Today, many business owners install an antivirus program as their single line of defence and call it a day. However, there are many ways to get into a network that circumvents anti-virus. Hackers are creating malware faster than anti-virus programs can recognise them...

Is Your Business Ready for Coronavirus Lockdown?

With the COVID-19 coronavirus continuing to spread in the UK, and Italy and China placing lockdowns on their towns and cities, it seems likely that the UK will follow suit if the outbreak continues apace.  Experts have stated today that the spread of the virus in the...

5 Reasons why cybersecurity awareness training is a good investment

Cyber attacks are on the rise. Any business that has experienced any form of internet security breach knows that it can be costly in terms of time and money. The reputation of a business is also at stake if client data is compromised. Cybersecurity is an issue that...

Serious Flaws Discovered in D-Link Routers

Researchers at Fortinet have uncovered serious flaws in four D-Link routers.  The router vulnerabilities were found to allow for remote code execution which means a remote attacker could gain control of your router, snoop on your traffic and redirect your browser to...

Blisstech Solutions sponsors KEMP’s Virtual Santa Fun Run

In 2020 everything has been different, and the traditional KEMP Hospice Santa Fun Run is no exception.  In a year where so many charity and participation events have been cancelled, it is great to see that this iconic local event is going ahead, albeit in a very...

Why is my computer so slow!?

“Why is my computer so slow?” is a question heard time and time again and is one of the most common computer complaints. There are a variety of reasons that your computer can appear to be running slowly. I say ‘appear’ as it may not actually be your computer that is causing the problem. Read on to find out possible reasons for this problem.

Homeworking is bad for IT security

A new homeworking security report from CyberArk has surveyed 3000 remote office workers and IT professionals. It finds that increased homeworking, resulting from the 2020 pandemic, could be bad news for a company’s IT security posture. It has uncovered several...

How to scan a QR code with your phone

As more venues open up for face to face meetings, some are introducing their own track and trace systems using a QR code that you need to scan with your mobile phone. But how? This video explains how to scan a QR code with your phone so you are not trying to figure it...

Getting Started With Microsoft Teams

Microsoft Teams is a powerful collaboration tool and is included with all business versions of Microsoft 365.  If you have Microsoft 365, and are not using Teams, or you don't yet have Microsoft 365 and want to know what Teams can do, this video is a quick...
Share This