Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

06:15 PM
Connect Directly

DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack

Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.

Tens of millions of Internet connected devices — including medical equipment, storage systems, servers, firewalls, commercial network equipment, and consumer Internet of Things (IoT) products — are open to potential remote code execution and denial-of-service attacks because of vulnerable DNS implementations.

A new study that Forescout Research Labs and JSOF Research conducted recently has uncovered a set of nine vulnerabilities in four TCP/IP stacks present in billions of devices worldwide. The four stacks in which the vulnerabilities exist are FreeBSD, Nucleus NET, NetX, and IPnet.  

Related Content:

High-Severity Vulnerabilities Discovered in Multiple Embedded TCP/IP Stacks

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

"These vulnerabilities affect many devices because of the widespread nature of implementations in TCP/IP stacks," says Daniel dos Santos, research manager at Forescout. Significantly, such vulnerabilities are likely to be more widespread than just on TCP/IP stacks, he says. "Any software that processes DNS packets may be affected, such as firewalls, intrusion detection systems, and other network appliances," dos Santos says. "That is why we are releasing tools for other researchers and developers to find and fix these problems."

FreeBSD is used in many high-performance servers, printers, firewalls, and embedded systems deployed on IT networks around the world, including at major companies such as Yahoo and Netflix. Nucleus NET is part of Nucleus RTOS, a real-time operating system from Siemens that is used in many industrial systems, medical, automation, and airborne systems. The OS is most commonly found in devices used for building automation and in operational technology and VoIP environments. NetX is commonly run by ThreadX, a real-time operating system found in many medical devices, energy equipment, printers, and power equipment in industrial control system environments. Meanwhile, the vulnerability that Forescout and JSOF discovered in IPnet was previously discovered by other researchers and quietly fixed, so it presents a smaller threat that the other flaws.

In a new technical report, Forescout and JSOF describe the set of nine vulnerabilities they discovered as giving attackers a way to knock devices offline or to download malware on them in order to steal data and disrupt production systems in operational technology environments. Among the most affected are organizations in the healthcare and government sectors because of the widespread use of devices running the vulnerable DNS implementations in both environments, Forescout and JSOF say.

According to the two companies, patches are available for the vulnerabilities in FreeBSD, Nucleus NET, and NetX. Device vendors using the vulnerable stacks should provide updates to customers. But because it may not always be possible to apply patches easily, organizations should consider mitigation measures, such as discovering and inventorying vulnerable systems, segmenting them, monitoring network traffic, and configuring systems to rely on internal DNS servers, they say. The two companies also released tools that other organizations can use to find and fix DNS implementation errors in their own products.

Device vendors often do not issue patches for vulnerabilities that affect third-party components that are integrated with other software in their products, dos Santos says. "Even if patches are issued, they have to be applied to devices that are difficult or impossible to take offline because they are mission-critical," he says, pointing to medical devices and industrial control systems as examples.

Message Compression
Forescout and JSOF discovered the nine vulnerabilities while conducting a study on underlying security problems in Doman Name System implementations. The study was part of a broader research effort called "Project Memoria" that Forescout has been leading to understand the security of TCP/IP stacks. The effort has led to the discovery of scores of TCP/IP stack vulnerabilities over the past year. In June 2020, Forescout and JSOF disclosed a set of 19 vulnerabilities, collectively dubbed Ripple20, on the Treck TCP/IP stack. Last December, Forescout disclosed Amnesia:33, a collection of 33 bugs across four open source TCP/IP stacks; and in February 2021, the company announced Number:Jack, a set of nine vulnerabilities in the so-called Initial Sequence Number implementation found in nine TCP/IP stacks.

The latest set of nine vulnerabilities have been collectively labeled Name:Wreck. The two companies uncovered them while analyzing the implementation of what is known as DNS message compression in a total of eight TCP/IP stacks. Four of the stacks turned out to have vulnerabilities ranging in severity from moderate to critical — though not all of the flaws were related to message compression protocol.

Dos Santos explains message compression as a feature of the DNS protocol that allows servers to send shorter messages to save on bandwidth consumption and for other reasons. The protocol historically has been vulnerable because the manner in which the decompression works gives attackers a way to manipulate it, he says. Five of the nine newly disclosed vulnerabilities disclosed resulted from a memory compression issue. The list includes a critical remote code execution (RCE) issue in Nucleus NET, a denial-of-service (DoS) flaw in NetX, and an RCE flaw in FreeBSD.

Three of the flaws — including one of critical severity — exist in Nucleus NET and result from problems with a process called domain name label parsing. "Domain name label parsing is what a DNS client must do when processing a DNS packet received from a server," dos Santos says. Forescout and JSOF found that in some cases, the length of a label specified in a packet was different from its actual length. In other cases, there were no markers to note the end of a label. "In both cases, the parser may continue reading a packet past a certain point where the label has finished, which can lead it to access protected memory regions and crash a device running this code." The remaining vulnerability — also in Nucleus NET — is of medium severity and leads to DNS cache poisoning.

The DoS vulnerabilities are easier to exploit than the RCE flaws because the attacker only needs to send malformed packets to crash a device. "The remote code executions are harder because the attacker has to craft a packet in a way that it will hijack the code execution in the device and inject malicious code," dos Santos says. Pulling off such an attack would require the adversary to have knowledge about the internals of a device and how to fine-tune the attacks for different devices, he says.

Dos Santos says it's hard to predict how, and how widely, attackers will exploit the newly disclosed flaws. But there have been numerous attacks leveraging similar weaknesses in DNS servers previously, he says. As examples, Santos points to a 2018 attack on an Amazon service that redirected users of cryptocurrency websites to malicious domains, and a DNS server hijacking campaign in 2019 that aimed at government agencies around the world. "The vulnerabilities we are presenting now affect DNS clients," he says, "which is a somewhat overlooked part of DNS security that also allows for severe attacks."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-10-15
Mitsubishi Electric SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.
PUBLISHED: 2021-10-15
Mitsubishi Electric SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.
PUBLISHED: 2021-10-15
Yealink Device Management (DM) allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
PUBLISHED: 2021-10-15
IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information.
PUBLISHED: 2021-10-15
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.