Microsoft Warns of New DNS Attacks
- By Stephen Swoyer
- April 13, 2007
Microsoft Corp.'s far from silent spring continues.
Yesterday, the software giant published
a new security advisory warning of a new spate of attacks
targeting a DNS vulnerability in its Windows server operating systems.
Microsoft says the "limited attack" targets a DNS vulnerability which
affects Windows 2000 Server (SP4) and Windows Server 2003 (all versions). Windows
client operating systems aren't affected, Redmond said, because they don't ship
with Microsoft's DNS service.
The new DNS attacks, like other recent exploits, could allow a remote code
execution scenario, assuming that an attacker successfully compromises a vulnerable
system. In this case, Microsoft confirms, the attacker could run code in the
all-powerful Local System context -- the same security context in which the
Windows DNS service itself runs.
The attack targets the Windows DNS RPC interface, which appears to be susceptible
to a classic stack-based buffer overrun exploit. One workaround, Microsoft indicated,
is to disable support for DNS remote management over RPC in the Windows registry.
This doesn't actually patch the underlying vulnerability, the software giant
conceded, but does effectively insulate DNS from attack. This is also a recommended
security practice, experts said -- although it isn't always feasible, given
DNS topologies in many organizations.
"It depends on whether you need to be able to remotely manage the organization
in various physical proximities, so there's good reason for [DNS servers] to
be in disparate locations, and therefore a logical reason why you might need
to do [DNS management over RPC]," said Russ Cooper, a senior information
security analyst with Cybertrust Inc., and founder/editor of the NTBugtraq mailing
list. "That said, why not use Terminal Services instead? Then you can disable
the RPC and use [RDP], assuming you've enabled Terminal Services [on remote
Microsoft hasn't yet issued a patch; in its security advisory, Redmond said
it is investigating the attacks and could issue a patch in the future.
The new warning comes only days after security researchers disclosed the possibility
new vulnerabilities in Microsoft's Word 2007 application, as well as a vulnerability
in its Windows .HLP file implementation. Redmond earlier this week published
security bulletins which collectively patch six vulnerabilities in its Windows
and Windows Content Management Server (CMS) offerings, as well.
Cooper, for his part, doesn't necessarily think there's been an uptick in attack
activity. He conceded, however, that targeted attacks seem to be a more frequent
"To be honest, I haven't thought of it in that way [as an uptick
in general attack activity]," Cooper said. "I guess if you group [the
new DNS attack] together with the alleged zero days in Microsoft Office, then,
yes, you could say there's an increase in targeted attack activity. We have
been concerned with targeted attacks for about a year now, but in general is
there more attack traffic? I would say no. It's still the same old attack traffic
coming across as attachments in e-mail -- just a lot more [targeted activity]."
Stephen Swoyer is a contributing editor for Enterprise Systems. He can be reached at [email protected]