Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

End of Bibblio RCM includes -->
06:15 PM
Connect Directly

DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack

Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.

Tens of millions of Internet connected devices — including medical equipment, storage systems, servers, firewalls, commercial network equipment, and consumer Internet of Things (IoT) products — are open to potential remote code execution and denial-of-service attacks because of vulnerable DNS implementations.

A new study that Forescout Research Labs and JSOF Research conducted recently has uncovered a set of nine vulnerabilities in four TCP/IP stacks present in billions of devices worldwide. The four stacks in which the vulnerabilities exist are FreeBSD, Nucleus NET, NetX, and IPnet.  

Related Content:

High-Severity Vulnerabilities Discovered in Multiple Embedded TCP/IP Stacks

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

"These vulnerabilities affect many devices because of the widespread nature of implementations in TCP/IP stacks," says Daniel dos Santos, research manager at Forescout. Significantly, such vulnerabilities are likely to be more widespread than just on TCP/IP stacks, he says. "Any software that processes DNS packets may be affected, such as firewalls, intrusion detection systems, and other network appliances," dos Santos says. "That is why we are releasing tools for other researchers and developers to find and fix these problems."

FreeBSD is used in many high-performance servers, printers, firewalls, and embedded systems deployed on IT networks around the world, including at major companies such as Yahoo and Netflix. Nucleus NET is part of Nucleus RTOS, a real-time operating system from Siemens that is used in many industrial systems, medical, automation, and airborne systems. The OS is most commonly found in devices used for building automation and in operational technology and VoIP environments. NetX is commonly run by ThreadX, a real-time operating system found in many medical devices, energy equipment, printers, and power equipment in industrial control system environments. Meanwhile, the vulnerability that Forescout and JSOF discovered in IPnet was previously discovered by other researchers and quietly fixed, so it presents a smaller threat that the other flaws.

In a new technical report, Forescout and JSOF describe the set of nine vulnerabilities they discovered as giving attackers a way to knock devices offline or to download malware on them in order to steal data and disrupt production systems in operational technology environments. Among the most affected are organizations in the healthcare and government sectors because of the widespread use of devices running the vulnerable DNS implementations in both environments, Forescout and JSOF say.

According to the two companies, patches are available for the vulnerabilities in FreeBSD, Nucleus NET, and NetX. Device vendors using the vulnerable stacks should provide updates to customers. But because it may not always be possible to apply patches easily, organizations should consider mitigation measures, such as discovering and inventorying vulnerable systems, segmenting them, monitoring network traffic, and configuring systems to rely on internal DNS servers, they say. The two companies also released tools that other organizations can use to find and fix DNS implementation errors in their own products.

Device vendors often do not issue patches for vulnerabilities that affect third-party components that are integrated with other software in their products, dos Santos says. "Even if patches are issued, they have to be applied to devices that are difficult or impossible to take offline because they are mission-critical," he says, pointing to medical devices and industrial control systems as examples.

Message Compression
Forescout and JSOF discovered the nine vulnerabilities while conducting a study on underlying security problems in Doman Name System implementations. The study was part of a broader research effort called "Project Memoria" that Forescout has been leading to understand the security of TCP/IP stacks. The effort has led to the discovery of scores of TCP/IP stack vulnerabilities over the past year. In June 2020, Forescout and JSOF disclosed a set of 19 vulnerabilities, collectively dubbed Ripple20, on the Treck TCP/IP stack. Last December, Forescout disclosed Amnesia:33, a collection of 33 bugs across four open source TCP/IP stacks; and in February 2021, the company announced Number:Jack, a set of nine vulnerabilities in the so-called Initial Sequence Number implementation found in nine TCP/IP stacks.

The latest set of nine vulnerabilities have been collectively labeled Name:Wreck. The two companies uncovered them while analyzing the implementation of what is known as DNS message compression in a total of eight TCP/IP stacks. Four of the stacks turned out to have vulnerabilities ranging in severity from moderate to critical — though not all of the flaws were related to message compression protocol.

Dos Santos explains message compression as a feature of the DNS protocol that allows servers to send shorter messages to save on bandwidth consumption and for other reasons. The protocol historically has been vulnerable because the manner in which the decompression works gives attackers a way to manipulate it, he says. Five of the nine newly disclosed vulnerabilities disclosed resulted from a memory compression issue. The list includes a critical remote code execution (RCE) issue in Nucleus NET, a denial-of-service (DoS) flaw in NetX, and an RCE flaw in FreeBSD.

Three of the flaws — including one of critical severity — exist in Nucleus NET and result from problems with a process called domain name label parsing. "Domain name label parsing is what a DNS client must do when processing a DNS packet received from a server," dos Santos says. Forescout and JSOF found that in some cases, the length of a label specified in a packet was different from its actual length. In other cases, there were no markers to note the end of a label. "In both cases, the parser may continue reading a packet past a certain point where the label has finished, which can lead it to access protected memory regions and crash a device running this code." The remaining vulnerability — also in Nucleus NET — is of medium severity and leads to DNS cache poisoning.

The DoS vulnerabilities are easier to exploit than the RCE flaws because the attacker only needs to send malformed packets to crash a device. "The remote code executions are harder because the attacker has to craft a packet in a way that it will hijack the code execution in the device and inject malicious code," dos Santos says. Pulling off such an attack would require the adversary to have knowledge about the internals of a device and how to fine-tune the attacks for different devices, he says.

Dos Santos says it's hard to predict how, and how widely, attackers will exploit the newly disclosed flaws. But there have been numerous attacks leveraging similar weaknesses in DNS servers previously, he says. As examples, Santos points to a 2018 attack on an Amazon service that redirected users of cryptocurrency websites to malicious domains, and a DNS server hijacking campaign in 2019 that aimed at government agencies around the world. "The vulnerabilities we are presenting now affect DNS clients," he says, "which is a somewhat overlooked part of DNS security that also allows for severe attacks."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file