New security threats as DNS flaw is uncovered

John A 0 569 Views

If you're visiting a known site such as Google.com, you're perfectly safe, right? Wrong. New DNS vulnerabilities in Microsoft's Windows 2000 and 2003 severs could potentially allow a DNS server to get hijacked, and redirect a user to a completely different site than they expected to see.

The vulnerability exists in the RPC protocol (Remote Procedure Call), which is supposed to get services from other applications on the network. By using a basic stack overflow technique, hackers can compromise the target machine and gain access to the routing table.

This becomes extremely dangerous. Cybercrooks could redirect a visitor to a phishing site instead of the site they originally intended to visit, stealing credit card information and personal information. Email could be rerouted to different servers.

Seeing how old Windows 2000 is, it's a little surprising that someone didn't discover this sooner. Nearly 7 years since it was released, and a vulnerability that's so simple to take advantage of for any somewhat-knowledgeable hacker.

Good news is that owners of servers running on Windows XP and Vista have nothing to worry about; the security bug does not exist in these versions.

While you're waiting for your Windows 2000 server to get patched by Microsoft, they recommend disabling the remote-administration option which is needed to exploit the vulnerability. There's also ports that you can block on your firewall which will effectively stop RPC, and thus the attacks.

Perhaps now server owners see a benefit to upgrading to Vista...

Dani AI

Generated

As pointed out, this turned out to be a real, serious DNS‑server issue rather than a browser problem: Microsoft published the fix as MS07‑029 (the DNS RPC management vulnerability, CVE‑2007‑1748). The bug is a stack overflow in the DNS RPC interface that can allow remote code execution; Microsoft released an update and published defensive guidance. (learn.microsoft.com)

Practical, short checklist for admins (apply in this order):

  • Confirm whether the machine is running the DNS Server service and whether it’s reachable from untrusted networks (check Services MMC or sc query dns; verify listening ports with netstat -an | findstr :53).
  • If possible, install Microsoft’s patch (KB935966 / MS07‑029) immediately; the bulletin includes the appropriate downloads and supported install switches (examples such as Windowsserver2003‑kb935966‑x86‑enu /quiet are documented). A reboot is required after the update. (learn.microsoft.com)

If you cannot patch right away, use the documented mitigations:

  • Disable remote DNS RPC management by creating the DWORD RpcProtocol under HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters and set it to 4 (mitigates remote RPC management) or 0 (disables DNS RPC completely). Example:

    reg add "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v RpcProtocol /t REG_DWORD /d 4 /f
net stop dns
net start dns

    Note: setting 4 prevents remote DNS RPC management (local and terminal‑services management still work); 0 disables all RPC management and has a larger operational impact.

  • Block unsolicited inbound TCP/UDP 139 and 445 and all unsolicited inbound ports >1024 at your perimeter firewall (or use IPsec filters) — blocking 445 will also affect SMB. These mitigations are the ones Microsoft tested. (learn.microsoft.com)

Scan and verify: use MBSA/WSUS or vulnerability scanners (Nessus/Tenable, the Nmap NSE script smb‑vuln‑ms07‑029) to find unpatched servers before they’re exploited. Exploit code existed in the wild at disclosure, so prioritize high‑risk hosts (DNS servers, domain controllers, Small Business Servers). (tenable.com)

References (official details and mitigations):

(Keeping DNS servers patched and unreachable from untrusted networks is the single best defense.)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview