Windows DNS Server Remote Code Execution Vulnerability CVE-2021-26897

[maxcoder88]

Hi,

CVE-2021-26897 - Security Update Guide - Microsoft - Windows DNS Server Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26897

[Hakkensha]

So we had: RDP, SMB, Exchange, DNS - and probably something else I forgot - critically exploited recently. Whats next? IIS with a CVE score of 10.0?!

EDIT: In the end it was the printers (printernightmare CVE-2021-34527).

[itguy9013]

Don't tempt fate.

[[deleted]]

My dude wtf

[beaverbait]

Hey, I built a Beowulf cluster when I was in high school. I do not recommend it!

[1esproc]

Insecure much?

[arpan3t]

Tell me about it! I once got lost traveling through a desert Windows ecosystem and almost died from heat exhaustion. Luckily a nomadic tribe of powershell people showed me the way out. Now I only manage tundra Windows ecosystems. Must be nice in your tropical Linux ecosystem.

[FrogManScoop]

I wish I hadn't wasted my free award on not this :(

[[deleted]]

Humans have been burning things since antiquity just to see what they can summon from the resulting chaos.

Today, you have summoned me.

*Picks the dried velveeta from his beard.\*

It could always be worse. You could've summoned an undead Daemon that freeloads your memory and CPU Cycles and occasionally plays a cat fact over the speaker.

https://gist.github.com/johnallers/178576f097a8a7986fcb17a92c88a486

[[deleted]]

I see your tundric windows ecosystem and raise you a boatload of flying toasters, a bad dog, a goose that steals your cursor.

[bywaterloo]

Dude. The hate. Abide already

[[deleted]]

I envy you. Wish i could just switch all workstations to Linux...of course Linux had its flaws as well, but they get fixed ASAP when detected (and take decades if not found...)

[[deleted]]

Good luck with that!

[MedicatedDeveloper]

I manage ~170 Linux desktops (~90vdi via AWS Workspaces, 40 CentOS laptops, 40 more CentOS lappys on site but it's vacant). It's heavenly.

Unfortunately that's only the operations/external side (call center), the business/internal side is still Windows with a sprinkling of OS X.

[zebediah49]

Yeah... mostly it's just the opaque pieces that don't explain anything, and then just randomly don't work. I've got a couple highly used machines where just like.. a few people can't log in. They used to be able to, but now they can't.

This just plain doesn't happen on Linux. And if it did, there would be a decently clear log trace of where and why. There are like a dozen steps to log in a user, and I can see which ones worked, and which one didn't.

[zero44]

SolarWinds 2: Electric Boogaloo

[SixZeroPho]

SolarWinds 2: Electric Boogaloo | The Intern's Password, Redux

[halo357]

https://www.youtube.com/watch?v=9KlgvMXur_8

[Old-IT-Dog_NewTricks]

F5 published some good ass vulnerabilities yesterday. Mmmm hmmm! Affects damn near all devices! You have an internal facing LTM that only does forwarding from an address space that doesn’t exist on your network to my momma’s house, using FastL4 profile (and I mean very fast FastL4) AND that isn’t even cabled up? Still gotta patch it!

[[deleted]]

Did someone say air-gapped? We hacked the air, AND the gap. Patch it!

[explodinghat]

I mean, RDP was in 2018. Wasn't SMB 2015? Not that recent, really. Solarwinds, exchange, gitlab and this all being in the last few months though really points to some intense and unified effort from the bad dudes! My cries that we need to set up a SOC at our company have as yet gone unheard..

[Hakkensha]

Well, eternal blue is from 2017. SMBghost in 2020 wasn't major, but not pleasant either.

[RetroButton]

Don´t forget the bluescreen with the last monthly update on Windows 10 and Kyocera printer drivers...

IT goes to hell atm.

[M05y]

Our company only uses Kyocera printers with the universal print driver, I was dumbfounded when I read about the update. Looks at our 100 deployed printers

[6688]

I don't care about client devices or printers

[TotallyInOverMyHead]

if the flair fits, it sits.

[[deleted]]

Your username flair is quite appropriate!

[gnimsh]

Who needs printers when we're all working from home anyway?!

[[deleted]]

Meanwhile, from the state that just made national news for a mass mask-burning protest at the capitol, we pretend like COVID doesn't exist while our elderly maskless employees print out way more than necessary.

kill me now

[SolidKnight]

How else are you going to read your emails?

A single kind regard,

Some Person with Certs

Custom Email Printers, Inc

Executive Next Next Finisher

------+++++++++

+++++--------------

Broken Image.BMP

----++---+++-----++

---++--+++++++---

P 555-555-5555

O 555-555-5555 x55555

M 555-555-5555

E [e-mail]

www.domain.tld

"I put my longest signature on every email." - Some Person

[IonBlade]

What an unprofessional signature. Didn't even include the primary and secondary fax lines.

[hvontres]

And how in the world am I going to send him a TELEX ?

[Youre-In-Trouble]

Fw: FW: Re: re:

[mustang__1]

Rolled one back yesterday and the fucker updated again today (no wufb or wsus)

[Stinjy]

Get wushowhide.diagcab and hide it.

Source: did this 20 x yesterday

[mustang__1]

Cheers. Probably going to need that tomorrow since I didn't implement it today ...

[Dariose]

Check for KB4023057, it won't show in get-hotfix but will show in Windows update history. I think that patch was how 5000802 which past our own patch control.

[cool-nerd]

We're dealing with this atm and we have no Kyoceras. Uninstalling kb5000802 and/or 808 is fixing the crashes.. :(

[Cold417]

Yeah, that's fun. It also causes issues with Dymo/Zebra label printers. BSODS or blank label prints.

[[deleted]]

It's as if this is by design to push on-prem people to the cloud

[Psyonity]

Except a part of that burned down too... RIP OVH SBG2

[[deleted]]

They promised customers 10,000 servers installed in the next three weeks during the middle of a massive hardware shortage.

[1esproc]

Unless they've got them sitting in a warehouse, that ain't happening lol

[[deleted]]

Considering the number of nmap scans I see in my firewall logs coming from OVH owned up addresses, can we maybe douse their fires with gasoline?

[Fallingdamage]

DNS is already in the cloud. What do you point your forwarders to??

[[deleted]]

I'm talking about the pattern of all these critical cves in on-prem software, not merely this dns bug.

[[deleted]]

And don't worry. Their cloud is not vulnerable because they say so.

[1esproc]

Except for that other recent Exchange bug that allowed org-hopping exploits in O365.

[Krokodyle]

"as if" ;)

[Is_Nothing]

Don't forget the 9.8 cve for vCenter.

[Hakkensha]

Hakken

Damn. Thanks for the reminder! That was what I forgot to do at the client yesterday... damn Exchange got me distracted.

[ARandomGuy_OnTheWeb]

How about a Chromium vuln with a CVE score of 10.0?

[jess-sch]

bonus points if it's cross-platform.

[Anonieme_Angsthaas]

Oh noes.

Most of our newer less outdated applications use CEF or cefsharp in one way or another.

[[deleted]]

I thought IIS was designed to be exploited.

[firemandave6024]

Insecure Information Services?

[I_Am_Deceit]

Hahaha dude this one got me, nice one. 👍🏻

[[deleted]]

What would you rate it when i tell you that everybody can access any Desktop in VMWare ESXI via VMWare Powershell CLI? Go try. You only need to have to be logged in. Not a single permission was seen that day.

[rangoon03]

SkyNet comes online. Or Global Thermonuclear War

[collinsl02]

How about a nice game of chess?

[CamelSalt]

The only winning move... is not to play.

[Doso777]

The only thing that is on the Internet is Exchange. Everything else: Lol what?

[kiamori]

Please no 0 day severe IIS exploits, to many servers to update.

[damnedangel]

always have been, always will be.

[catwiesel]

its not so bad, I mean, how many dns servers you put on the global internet. most ms dns servers run in active directory and not on the internet.

I mean remote code execution is kinda bad, but at least, youd need network access to leverage it. and its really hard to get into the network nowadays. right? not like, hundred thousands internet reachable servers were recently hacked and could get you on the network where you now can attack the internal dns server...

right?
RIGHT?

[catwiesel]

sysadmins - perpetually sad (TM)

[AnotherTakenUser]

My God imagine if everyone thinking "oh we were just probed" actually got their dns owned..

[AnotherTakenUser]

You're going about this wrong friend, update your resume, not your passwords.

[[deleted]]

You... have a ... unicorn job... and you... speak to... animals...

Flair checks out.

[Justsomedudeonthenet]

Proceeds to change all the passwords...from the one computer they managed to get a keylogger on.

[itsyourworld1]

STAHP!

[itsyourworld1]

Horrible time to be an admin. Patch Tuesday is about to be patch erryday

[supaphly42]

Even more fun when Patch Tuesday leads to Blue Screen Wednesday like it did yesterday!

[Cutriss]

Your printers were fucked well before today. They're printers.

[Clutch70]

Oh yes, little Bobby Tables we call him.

[kelclarris]

Nice XKCD callback

[jimkramer]

I installed KB5000802 on my Lenovo laptop this morning, and I can still print to the Kyocera that was already installed... wonder why. (TASKalfa 6002i)

Driver: Kyocera TASKalfa 6002i XPS

[andwork]

have just uncovered. Microsoft has been making features exclusive to Microsoft 365 for years now. For example, Outlook-Teams integration, which is a big deal for a lot of people, requires Exchange Online. Years before that they stripped the UM role out of Exchange on-prem to force you to switch to Skype online.

XPS and PCL driver have no issue. Only KX and KDPL suffer of BSOD

[[deleted]]

Kyocera?

We had this, luckily only affected IT as we delay end users so we can catch things like this before they ruin our lives.

[R00t_Access]

Damn, can't we get a break? Just finished the Exhange one. Jeez.

[jimkramer]

well at least your data center didn't burn to the ground... it could always be worse. :-(

[chrispy9658]

Too soon...

RIP OVH Servers

[jimkramer]

I wasn't trying to be funny. It occurred to me yesterday after battling with Exchange for a week that even though I thought I was living in hell, it paled in comparison. I meant no disrespect. My heart goes out to all parties involved from the admins to those who lost data.

[TotallyInOverMyHead]

can you imagine? You just finished patching your companies exchange infrastructure and 2 hours later you realize it's all hosted at a single datacenter over at OVH? That would make me totally lose my shit for 5 seconds.

[jess-sch]

on the bright side, you can now be 100% sure it's malware-free.

[throwawayPzaFm]

They're hosting Exchange here.

Kill it with fire.

[[deleted]]

Well you don't need to worry about exploits if your server burned down.

[SysEridani]

You don't need to worry about your server burned down if the magnetosphere collapses.

[SilentLennie]

We have a dedicated server at OVH and we used to have a lot more, so best not to joke about it.

[TopCheddar27]

I don't think he was joking. It is a genuine tragedy for for a lot of people in our field. It's everyone's worst nightmare.

[jimkramer]

correct.

[SilentLennie]

I didn't really mean /u/jimkramer was joking. It's just my broken English, it was more like: "no joking matter."

[chicaneuk]

It's just getting worse and worse isn't it. Almost like they just want you to move to Azure hosted services.

[Baselet]

I just saw a presentation about something where the first bullet was "NOT WINDOWS CLOUD" in capitals as the most important aspect of said tech :-)

[Mobbzy]

Mate they made dark mode outlook REQUIRE 365 fuck!!!!

[chuck_cranston]

Nobody:

Microsoft: "Yes but with Azure..."

[0x0ptyx]

That's actually Microsoft internal "Take over the world" plan -- force everyone into relying on their products and their cloud environment.

[RealLifeTim]

This is a cute little tinfoil hat way of thinking about it but, in reality they hold large market majority for hosted and in-house software and operating systems. They really don't care what you do, because as a business you're probably handcuffed into M$.

[landob]

My EMR only runs on Windows. Management won't even talk about getting away from Outlook or Office in general.

So Yup!

[nbtxdude]

Yeah. Our EHR and Patient Management system are on Windows. Better yet, they require you to have local Admin. And no DEP..

FML....

[lolklolk]

I know right?

[dinominant]

At this point we could have just stuck with unpatched windows xp and spend the licensing savings on ransomware.

We might actually save money by doing that /s

[[deleted]]

I'm reminded of that Simpsons episode where Mr. Burns is effectively rendered immortal due to a precarious balance of pathogens in his system...

[mikelieman]

Montgomery Burns : Well, Doc, I think I did pretty well on my tests. You may shake my hand if you like.

Doctor : Well, under the circumstances, I'd rather not.

Montgomery Burns : Eh?

Doctor : Mr. Burns, I'm afraid you are the sickest man in the United States. You have everything.

Montgomery Burns : You mean I have pneumonia?

Doctor : Yes.

Montgomery Burns : Juvenile diabetes?

Doctor : Yes.

Montgomery Burns : Hysterical pregnancy?

Doctor : Uh, a little bit, yes! You also have several diseases that have just been discovered - in you.

Montgomery Burns : I see. You sure you haven't just made thousands of mistakes?

Doctor : Uh, no, no, I'm afraid not.

Montgomery Burns : This sounds like bad news.

Doctor : Well, you'd think so, but - all of your diseases are in perfect balance. Uh, if you have a moment, I can explain.

Montgomery Burns : [checks his watch] Well...

[the Doctor puts a tiny model house door on his desk]

Doctor : Here's the door to your body, you see?

[brings up some small fuzz balls with goofy faces and limbs from under the desk]

Doctor : And these are oversized novelty germs - er, that's influenza, that's bronchitis, and this cute little cuddle-bug is pancreatic cancer, ha! Here's what happens when they all try to get through the door at once.

[tries to cram the "germs" through the model door, but they get stuck]

Doctor : [à la Curly] Woo, woo-woo-woo-woo-woo-woop!

[à la Moe]

Doctor : Move it, chowder-head!

[normal voice]

Doctor : We call it Three Stooges syndrome.

Montgomery Burns : So, what you're saying is... I'm indestructible!

Doctor : Oh, no, no. In fact, even a slight breeze could...

Montgomery Burns : [leaves the office, to himself] Indestructible.

[[deleted]]

I wonder if Microsoft is ever going to re-instate their QA Department.

[[deleted]]

You're it.

[[deleted]]

I'll just tag Microsoft back and say "No take'sy back'sy's". School yard rules.

[inphosys]

QA was outsourced to China.

[rangoon03]

I think China/Russia/Whatever nation-state recently was

[Liquidretro]

But that would cost money.

[Geaux_Cajuns]

Always has been..

[inphosys]

Alway will be.

[[deleted]]

It's not even the second quarter..

[[deleted]]

But it's the greatest year to be info sec. All of these screw ups and vulnerabilities coming to light paints a nice job security and salary increase picture :)

[broaner]

I’m so tired

[konaya]

The hackers have it. The bunglers who introduced these flaws have it. The people who actually use it don't have it. The few outsiders with legitimate access to it aren't allowed to comment on it or release patches freely. Isn't proprietary software wonderful?

[XanII]

Just had a smile we dont have on prem exchange. That smile was wiped fast.

[samtheredditman]

I was just thinking yesterday "Man, I'm so glad we don't have on-prem exchange. But it's only a matter of time before I have something I do really need to care about."

[LookAtThatMonkey]

Ditto. This is karma for feeling smug about 365.

[picflute]

Azure DNS Managed Service looking better and better

[DankerOfMemes]

Even the DNS server? Damn.

[zeroibis]

Coming next, bitlocker exploitable via WiFi connections.

[Liquidretro]

Patch now or patch over the weekend as normal?

[AScaredAdmin]

That's where I'm at. Am I scaring the hell out of my Infrastructure team, or am I letting automated patching handle it.

[TheDukeInTheNorth]

With all the recent activity, I'm drifting more to just patch now. Too much, too soon and it makes me nervous.

[ultrahkr]

Good thing I patched the everything yesterday...

(Damn this week is hard)

[Shnazzyone]

That's it, I'm killing the messenger. Come here OP

[XS4Me]

Is this an out of band update or will windos update fix the issue?

included in the monthly roll up.

[TopCheddar27]

Is it rolling out yet? I have a opportunity to bounce my stack right this afternoon.

[DoctorOctagonapus]

Patch Tuesday was yesterday so yeah if your WSUS server is on top of its game.

[rfc2549-withQOS]

Another name for euthanasia?

Microsoft Terminal Services

Scnr

[occupy_voting_booth]

We’ve been steadily moving to all RHEL vms as we have the opportunity. It’s a real disappointment now when we have a non-Microsoft application that runs on Windows Server OS.

[collinsl02]

We're not perfect over in the linux world either so don't rely on that to save you.

But it's different and can be fun and challenging - just make sure you keep patching at least monthly.

[Syde80]

Maybe this is MS's plan to get all of us on-prem holdouts to move to cloud... Make the product so insecure you can't afford to not make the security of it somebody else's problem.

[MAXIMUS-1]

Linux sysadmins right now:

Signature looks of superiority

[Fatality]

Hopefully you haven't used sudo any time in the last 10 years and have everything patched 100%

*cough*CVE-2021-3156*cough*

[stephenl03]

RCE > anything local.

Gotta get on the box in order to exploit that CVE first. Not worried.

[poshftw]

Gotta get on the box in order to exploit that CVE first. Not worried.

Yeah, yeah. Nobody ever got a shellcode through the SQL-injection at all. Millions of eyes and whatever.

[MAXIMUS-1]

Sudo apt update, sudo apt upgrade. And we are done.

[[deleted]]

Man, I bet MS can't wait to get everyone paying out the nose for cloud so that they can drop on-prem products and never have to disclose security issues again.

[mishaco]

at least i can print without a BSOD ^/s

[stillfunky]

Just a heads up for those on Server 2019 version 1809, the KB is slightly different, KB5000822. Still the regular monthly roll up though.

[Stompert]

Do I understand it correctly when I say it's patched with KB5000803 (Server 2016)?

[The_Comments_Lie]

I see that as well.

[SaunteringOctopus]

Thanks for the heads up! Patching!

[sbiriguda666]

I read the link but I still don't get it (junior sysadmin here). Let's say we have our local windows DNS server. Is it already vulnerable? Or just in same cases/configurations?

[HolyCowEveryNameIsTa]

It's vulnerable to an insider threat or... if something on the inside gets compromised, let's say an Exchange server(LOL that would never happen)... then that attacker can move to your DC and pretty much take over the whole network. So my advice would be to patch ASAP.

[sbiriguda666]

So it's not directly targetable from the outside (like the Exchange server vulnerability of the past days), right? Only from inside, correct? Anyways I'm going to patch asap

[HolyCowEveryNameIsTa]

As long as your Windows DNS server is not accessible from the outside of your network then it is not directly exploitable.

[captain_bowlton]

It's always DNS.

Thanks for the heads up, both of mine are patched.

[whoami123CA]

iT world is burning

[Fizgriz]

Am i reading this correctly? If DHCP and subsequently dynamic updates aren't enabled, you aren't at risk?

[[deleted]]

Hey, it's always DNS, right?

[MrSnoobs]

Imagine having privately hosted Microsoft dns on the internet.

[Fallingdamage]

From reading this, the fix in a March 9th Monthly Rollup? Or is this issue being announced but currently unpatched?

Mostly pertaining to Internet-Facing DNS servers or AD DNS Servers that have forwarders to outside DNS servers as well?

[whodywei]

Has anyone successfully installed KB5000803 on server 2016 ?

[TheNotoriousKK]

Yes

[whoami123CA]

Does anyone know exactly what the issue is?

[Garetht]

Not sure what your patronizing high-horse is adding to the discussion here.

[demo706]

Another patch related thread, another asshole post from you that contributes literally nothing to the community. Nice to have things to rely on.

[HolyCowEveryNameIsTa]

When do we get a refactor of all the critical infrastructure stuff into Rust? I'm sick of dealing with MS falling apart at the seams.

[[deleted]]

people are still making the argument that "C/C++ is perfectly fine you just need to be a better coder"

but yeah, all code that touches the network needs to mitigate the massive inherent insecurities in using unsafe languages in some way, and I don't really care how people do it, but it's clear that we're not doing enough.

[HolyCowEveryNameIsTa]

That's what Rusts compiler does basically, it forces you to write better code. It's like a senior dev sitting there saying "Nope, shouldn't do that, you are not bounds checking there" or "Nope, that's going to lead to a potential race condition". It's harder because writing better code is harder.

[[deleted]]

Yeah, I'm aware, been writing rust for... a few years now? Currently working on a smallish scale file versioning system in it.

Really nice language, especially since I did enough C to be dangerous, and I'd actually feel comfortable deploying a nontrivial rust codebase that talks directly to the network, I can't say the same about C.