Microsoft urge users to patch against critical vulnerability
Author : Matt Yarranton
16 July 2020

Microsoft is warning of a recently discovered critical Windows DNS Server vulnerability that is described as “wormable”. DNS (Domain Name Services) is used by computers all over the world to find each other. The Internet could not work without it. Microsoft DNS is specifically used inside businesses all over the world and allows Windows systems to locate computers and services within the business network. If a business is running Windows desktops and servers, they are almost certainly using Microsoft DNS.

Such a flaw could allow attackers to create special malware that remotely executes a code on Windows servers and creates malicious DNS queries that could even eventually lead to a company’s entire network being compromised.

“Wormable vulnerabilities have the potential to spread via malware between vulnerable computers without user interaction,” “Windows DNS Server is a core networking component. While this vulnerability is not currently known to be used in active attacks, it is essential that customers apply Windows updates to address this vulnerability as soon as possible.” explained Mechele Gruhn,  a principal security program manager at Microsoft.

This vulnerability is as bad as it gets

If you want more detail of what a worm is, remember WannaCry?  This took advantage of the wormable EternalBlue exploit in Windows’ Server Message Block (SMB).   The Common Vulnerability Scoring System (CVSS), gave EternalBlue an 8.5/10 score for severity. If you want a comparison, this new DNS vulnerability has been allocated a severity score of 10/10.

In a blog post published Tuesday, Check Point described in detail how the bug works, and have named the flaw SIGRed, and also said it believes there’s a high chance of this vulnerability being exploited.

“Every organization, big or small using Microsoft infrastructure is at major security risk, if left unpatched. The risk would be a complete breach of the entire corporate network. This vulnerability has been in Microsoft code for more than 17 years; so if we found it, it is not impossible to assume that someone else already found it as well.”

Hard disks in an array lit by blue light

Patch as soon as possible

If you are a home user you needn’t worry as Windows 10 and other DNS client systems are not affected; this only affects Windows servers running DNS.  If you have Active Directory in your organisation, you will be running Microsoft DNS.

Microsoft has released a patch, and affected systems should have this applied as soon as possible.  If applying the update quickly is not practical, a registry-based workaround is available that does not require restarting the server. The update and the workaround are both detailed in CVE-2020-1350.

If you are not sure how this affects you, please get in touch with us. We can help.

More Content

Why you should use a password manager

Introduction It can be difficult to keep track of all of your online passwords, especially if you have multiple accounts for different purposes.  But did you know that there is a way to keep all of your passwords safe and secure? A password manager such as LastPass...

Why the Cloud is not backup

Cloud computing has revolutionised the way businesses work.  Companies that utilise the cloud will have coped the best with COVID-19 imposed restrictions.  Whether forced to by circumstance or not, businesses are moving from the traditional server in the office to...

Migrate to Microsoft 365 manually using PST files

When you are migrating to Microsoft 365 from an existing email provider, you'll want to migrate the emails, contacts and calendar from your users existing mailboxes to their shiny new Microsoft 365 mailboxes.  The best-case scenario is your provider will migrate you...

What’s coming in Windows 11?

Microsoft has just announced (in a typically 'West Coast'​ way) what's coming in Windows 11.  Here is a rundown of what was announced at the event. Windows 11 Interface Design The first impression visually is that it looks kind of like Linux merged with Mac OSx. The...

Spam emails are losing your business hundreds of hours every year

Spam emails: Very annoying and everyone hates them! They take up your time and make it hard for you to get other work done! A recent study found that each one of our employees could be losing 80 hours per year due the hassle associated with managing spam. That’s a LOT...

VIDEO: How to managed Focused and Junk email in Outlook

Welcome to a new Tuesday Two Minute Tech Tip that will help you to manage what you see in your Inbox. Are you wondering where your emails have gone? Is something you expect to see in your Inbox not arriving anymore? This video will show you how to:    👉...

What does the global chip shortage mean for your business?

For the past couple of years, the tech world has been struggling with a global chip shortage. But it’s not just tech businesses that are feeling the impact. So many of the things we use every day contain a chip. Laptops and desktops, sure. But also household...

VIDEO: How to use footnotes and endnotes in Word

This Tech Tip is another tip for Microsoft Word. If you use Word to write documentation, contracts or any other type of detailed document, then this tip is for you. Usually, when you write such a document, you may need to expand on certain sentences without making the...

VIDEO: How to create a table of content in Word

Happy Tuesday everyone! Today's Two Minute Tech Tip was an idea given to me by my apprentice, George Borns. When asked what would be a good idea for a Tech Tip and without hesitation, George said "What about headings and tables of content in Word?" It is a great tip...

How to scan a QR code with your phone

As more venues open up for face to face meetings, some are introducing their own track and trace systems using a QR code that you need to scan with your mobile phone. But how? This video explains how to scan a QR code with your phone so you are not trying to figure it...
Share This