微软 Windows DNS Server 远程代码执行漏洞

漏洞编号：CVE-2020-1350

威胁程度：高

影响范围：

• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core)     
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core)     
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core)     
• Windows Server 2012
• Windows Server 2012 (Server Core)     
• Windows Server 2012
• Windows Server 2012 (Server Core)     
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core)     
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core)     
• Windows Server 2016
• Windows Server 2016 (Server Core)     
• Windows Server 2019
• Windows Server 2019 (Server Core)
• Windows Server, version 1903 (Server Core)
• Windows Server, version 1909 (Server Core)
• Windows Server, version 2004 (Server Core)

漏洞描述：

2020年7月15日，微软发布补丁修复了一个标注为远程代码执行的DNS Server漏洞，官方分类为“可蠕虫级”高危漏洞，易受攻击的漏洞有可能通过恶意软件在易受攻击的计算机之间传播，而无需用户干预。CVSS评分10分（即高危且易利用），漏洞编号CVE-2020-1350。

未经身份验证的攻击者可以发送特殊构造的数据包到目标DNS Server来利用此漏洞，成功利用此漏洞可能达到远程代码执行的效果。如果域控制器上存在DNS服务，攻击者可利用此漏洞获取到域控制器的系统权限。

缓解措施：

通过注册表编辑器，限制tcp包的长度

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters 

 DWORD = TcpReceivePacketSize 

 Value = 0xFF00

然后，重启DNS服务生效。

Check Point 报告请见：

https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/

KnowSafe

https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/

DNS服务器