Microsoft issued guidance on how to mitigate a DNS cache poisoning vulnerability reported by security researchers from the University of California and Tsinghua University.
Successfully exploiting the vulnerability could allow attackers to use modified DNS records to redirect a target to a malicious website under their control as part of DNS spoofing (also known as DNS cache poisoning) attacks.
The end goal of such attacks is to either exploit device or software vulnerabilities to infect the target with malware or to harvest sensitive information via a phishing landing page.
Impacts multiple Windows server platforms
The addressing spoofing vulnerability – tracked as CVE-2020-25705 and nicknamed SAD DNS (Side-channel AttackeD DNS) – exists in the Windows DNS Resolver software component that comes bundled with the Windows Transmission Control Protocol/Internet Protocol (TCP/IP) stack.
“Microsoft is aware of a vulnerability involving DNS cache poisoning caused by IP fragmentation that affects Windows DNS Resolver,” the company explains in a security advisory published as part of this month’s Patch Tuesday.
“An attacker who successfully exploited this vulnerability could spoof the DNS packet which can be cached by the DNS Forwarder or the DNS Resolver.”
CVE-2020-25705 mitigation
To mitigate this vulnerability, Windows administrators can alter the Registry to change the maximum UDP packet size to 1,221 bytes which would block any DNS cache poisoning attacks attempting to exploit it on vulnerable devices.
To do that, admins are required to go through the following procedure:
- Run regedit.exe as Administrator.
- In Registry Editor, navigate to the
HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameterssubkey and set the following parameters: -
- Value: MaximumUdpPacketSize
- Type: DWORD
- Data: 4C5 Hexadecimal or 1221 Decimal
- Close Registry Editor and restart the DNS service.
After the registry update, the DNS resolver will now switch to TCP for all responses larger than 4C5 or 1221, automatically blocking any CVE-2020-25705 attacks.
According to researchers who discovered SAD DNS, CVE-2020-25705 also impacts other operating systems besides Windows including Linux, macOS, and FreeBSD, as well as other DNS resolvers including but not limited to BIND, Unbound, and dnsmasq.
Microsoft has also released security updates today to fix 58 vulnerabilities as part of December 2020 Patch Tuesday, nine classified as Critical, 48 as Important, and two as Moderate severity.
Ref: Bleeping Computer
