Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

End of Bibblio RCM includes -->
4/13/2021
06:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail

DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack

Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.

Tens of millions of Internet connected devices — including medical equipment, storage systems, servers, firewalls, commercial network equipment, and consumer Internet of Things (IoT) products — are open to potential remote code execution and denial-of-service attacks because of vulnerable DNS implementations.

A new study that Forescout Research Labs and JSOF Research conducted recently has uncovered a set of nine vulnerabilities in four TCP/IP stacks present in billions of devices worldwide. The four stacks in which the vulnerabilities exist are FreeBSD, Nucleus NET, NetX, and IPnet.  

Related Content:

High-Severity Vulnerabilities Discovered in Multiple Embedded TCP/IP Stacks

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

"These vulnerabilities affect many devices because of the widespread nature of implementations in TCP/IP stacks," says Daniel dos Santos, research manager at Forescout. Significantly, such vulnerabilities are likely to be more widespread than just on TCP/IP stacks, he says. "Any software that processes DNS packets may be affected, such as firewalls, intrusion detection systems, and other network appliances," dos Santos says. "That is why we are releasing tools for other researchers and developers to find and fix these problems."

FreeBSD is used in many high-performance servers, printers, firewalls, and embedded systems deployed on IT networks around the world, including at major companies such as Yahoo and Netflix. Nucleus NET is part of Nucleus RTOS, a real-time operating system from Siemens that is used in many industrial systems, medical, automation, and airborne systems. The OS is most commonly found in devices used for building automation and in operational technology and VoIP environments. NetX is commonly run by ThreadX, a real-time operating system found in many medical devices, energy equipment, printers, and power equipment in industrial control system environments. Meanwhile, the vulnerability that Forescout and JSOF discovered in IPnet was previously discovered by other researchers and quietly fixed, so it presents a smaller threat that the other flaws.

In a new technical report, Forescout and JSOF describe the set of nine vulnerabilities they discovered as giving attackers a way to knock devices offline or to download malware on them in order to steal data and disrupt production systems in operational technology environments. Among the most affected are organizations in the healthcare and government sectors because of the widespread use of devices running the vulnerable DNS implementations in both environments, Forescout and JSOF say.

According to the two companies, patches are available for the vulnerabilities in FreeBSD, Nucleus NET, and NetX. Device vendors using the vulnerable stacks should provide updates to customers. But because it may not always be possible to apply patches easily, organizations should consider mitigation measures, such as discovering and inventorying vulnerable systems, segmenting them, monitoring network traffic, and configuring systems to rely on internal DNS servers, they say. The two companies also released tools that other organizations can use to find and fix DNS implementation errors in their own products.

Device vendors often do not issue patches for vulnerabilities that affect third-party components that are integrated with other software in their products, dos Santos says. "Even if patches are issued, they have to be applied to devices that are difficult or impossible to take offline because they are mission-critical," he says, pointing to medical devices and industrial control systems as examples.

Message Compression
Forescout and JSOF discovered the nine vulnerabilities while conducting a study on underlying security problems in Doman Name System implementations. The study was part of a broader research effort called "Project Memoria" that Forescout has been leading to understand the security of TCP/IP stacks. The effort has led to the discovery of scores of TCP/IP stack vulnerabilities over the past year. In June 2020, Forescout and JSOF disclosed a set of 19 vulnerabilities, collectively dubbed Ripple20, on the Treck TCP/IP stack. Last December, Forescout disclosed Amnesia:33, a collection of 33 bugs across four open source TCP/IP stacks; and in February 2021, the company announced Number:Jack, a set of nine vulnerabilities in the so-called Initial Sequence Number implementation found in nine TCP/IP stacks.

The latest set of nine vulnerabilities have been collectively labeled Name:Wreck. The two companies uncovered them while analyzing the implementation of what is known as DNS message compression in a total of eight TCP/IP stacks. Four of the stacks turned out to have vulnerabilities ranging in severity from moderate to critical — though not all of the flaws were related to message compression protocol.

Dos Santos explains message compression as a feature of the DNS protocol that allows servers to send shorter messages to save on bandwidth consumption and for other reasons. The protocol historically has been vulnerable because the manner in which the decompression works gives attackers a way to manipulate it, he says. Five of the nine newly disclosed vulnerabilities disclosed resulted from a memory compression issue. The list includes a critical remote code execution (RCE) issue in Nucleus NET, a denial-of-service (DoS) flaw in NetX, and an RCE flaw in FreeBSD.

Three of the flaws — including one of critical severity — exist in Nucleus NET and result from problems with a process called domain name label parsing. "Domain name label parsing is what a DNS client must do when processing a DNS packet received from a server," dos Santos says. Forescout and JSOF found that in some cases, the length of a label specified in a packet was different from its actual length. In other cases, there were no markers to note the end of a label. "In both cases, the parser may continue reading a packet past a certain point where the label has finished, which can lead it to access protected memory regions and crash a device running this code." The remaining vulnerability — also in Nucleus NET — is of medium severity and leads to DNS cache poisoning.

The DoS vulnerabilities are easier to exploit than the RCE flaws because the attacker only needs to send malformed packets to crash a device. "The remote code executions are harder because the attacker has to craft a packet in a way that it will hijack the code execution in the device and inject malicious code," dos Santos says. Pulling off such an attack would require the adversary to have knowledge about the internals of a device and how to fine-tune the attacks for different devices, he says.

Dos Santos says it's hard to predict how, and how widely, attackers will exploit the newly disclosed flaws. But there have been numerous attacks leveraging similar weaknesses in DNS servers previously, he says. As examples, Santos points to a 2018 attack on an Amazon service that redirected users of cryptocurrency websites to malicious domains, and a DNS server hijacking campaign in 2019 that aimed at government agencies around the world. "The vulnerabilities we are presenting now affect DNS clients," he says, "which is a somewhat overlooked part of DNS security that also allows for severe attacks."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
//Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...