Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/13/2021
06:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack

Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.

Tens of millions of Internet connected devices — including medical equipment, storage systems, servers, firewalls, commercial network equipment, and consumer Internet of Things (IoT) products — are open to potential remote code execution and denial-of-service attacks because of vulnerable DNS implementations.

A new study that Forescout Research Labs and JSOF Research conducted recently has uncovered a set of nine vulnerabilities in four TCP/IP stacks present in billions of devices worldwide. The four stacks in which the vulnerabilities exist are FreeBSD, Nucleus NET, NetX, and IPnet.  

Related Content:

High-Severity Vulnerabilities Discovered in Multiple Embedded TCP/IP Stacks

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: 9 Modern-Day Best Practices for Log Management

"These vulnerabilities affect many devices because of the widespread nature of implementations in TCP/IP stacks," says Daniel dos Santos, research manager at Forescout. Significantly, such vulnerabilities are likely to be more widespread than just on TCP/IP stacks, he says. "Any software that processes DNS packets may be affected, such as firewalls, intrusion detection systems, and other network appliances," dos Santos says. "That is why we are releasing tools for other researchers and developers to find and fix these problems."

FreeBSD is used in many high-performance servers, printers, firewalls, and embedded systems deployed on IT networks around the world, including at major companies such as Yahoo and Netflix. Nucleus NET is part of Nucleus RTOS, a real-time operating system from Siemens that is used in many industrial systems, medical, automation, and airborne systems. The OS is most commonly found in devices used for building automation and in operational technology and VoIP environments. NetX is commonly run by ThreadX, a real-time operating system found in many medical devices, energy equipment, printers, and power equipment in industrial control system environments. Meanwhile, the vulnerability that Forescout and JSOF discovered in IPnet was previously discovered by other researchers and quietly fixed, so it presents a smaller threat that the other flaws.

In a new technical report, Forescout and JSOF describe the set of nine vulnerabilities they discovered as giving attackers a way to knock devices offline or to download malware on them in order to steal data and disrupt production systems in operational technology environments. Among the most affected are organizations in the healthcare and government sectors because of the widespread use of devices running the vulnerable DNS implementations in both environments, Forescout and JSOF say.

According to the two companies, patches are available for the vulnerabilities in FreeBSD, Nucleus NET, and NetX. Device vendors using the vulnerable stacks should provide updates to customers. But because it may not always be possible to apply patches easily, organizations should consider mitigation measures, such as discovering and inventorying vulnerable systems, segmenting them, monitoring network traffic, and configuring systems to rely on internal DNS servers, they say. The two companies also released tools that other organizations can use to find and fix DNS implementation errors in their own products.

Device vendors often do not issue patches for vulnerabilities that affect third-party components that are integrated with other software in their products, dos Santos says. "Even if patches are issued, they have to be applied to devices that are difficult or impossible to take offline because they are mission-critical," he says, pointing to medical devices and industrial control systems as examples.

Message Compression
Forescout and JSOF discovered the nine vulnerabilities while conducting a study on underlying security problems in Doman Name System implementations. The study was part of a broader research effort called "Project Memoria" that Forescout has been leading to understand the security of TCP/IP stacks. The effort has led to the discovery of scores of TCP/IP stack vulnerabilities over the past year. In June 2020, Forescout and JSOF disclosed a set of 19 vulnerabilities, collectively dubbed Ripple20, on the Treck TCP/IP stack. Last December, Forescout disclosed Amnesia:33, a collection of 33 bugs across four open source TCP/IP stacks; and in February 2021, the company announced Number:Jack, a set of nine vulnerabilities in the so-called Initial Sequence Number implementation found in nine TCP/IP stacks.

The latest set of nine vulnerabilities have been collectively labeled Name:Wreck. The two companies uncovered them while analyzing the implementation of what is known as DNS message compression in a total of eight TCP/IP stacks. Four of the stacks turned out to have vulnerabilities ranging in severity from moderate to critical — though not all of the flaws were related to message compression protocol.

Dos Santos explains message compression as a feature of the DNS protocol that allows servers to send shorter messages to save on bandwidth consumption and for other reasons. The protocol historically has been vulnerable because the manner in which the decompression works gives attackers a way to manipulate it, he says. Five of the nine newly disclosed vulnerabilities disclosed resulted from a memory compression issue. The list includes a critical remote code execution (RCE) issue in Nucleus NET, a denial-of-service (DoS) flaw in NetX, and an RCE flaw in FreeBSD.

Three of the flaws — including one of critical severity — exist in Nucleus NET and result from problems with a process called domain name label parsing. "Domain name label parsing is what a DNS client must do when processing a DNS packet received from a server," dos Santos says. Forescout and JSOF found that in some cases, the length of a label specified in a packet was different from its actual length. In other cases, there were no markers to note the end of a label. "In both cases, the parser may continue reading a packet past a certain point where the label has finished, which can lead it to access protected memory regions and crash a device running this code." The remaining vulnerability — also in Nucleus NET — is of medium severity and leads to DNS cache poisoning.

The DoS vulnerabilities are easier to exploit than the RCE flaws because the attacker only needs to send malformed packets to crash a device. "The remote code executions are harder because the attacker has to craft a packet in a way that it will hijack the code execution in the device and inject malicious code," dos Santos says. Pulling off such an attack would require the adversary to have knowledge about the internals of a device and how to fine-tune the attacks for different devices, he says.

Dos Santos says it's hard to predict how, and how widely, attackers will exploit the newly disclosed flaws. But there have been numerous attacks leveraging similar weaknesses in DNS servers previously, he says. As examples, Santos points to a 2018 attack on an Amazon service that redirected users of cryptocurrency websites to malicious domains, and a DNS server hijacking campaign in 2019 that aimed at government agencies around the world. "The vulnerabilities we are presenting now affect DNS clients," he says, "which is a somewhat overlooked part of DNS security that also allows for severe attacks."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32697
PUBLISHED: 2021-06-21
neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form F...
CVE-2020-19510
PUBLISHED: 2021-06-21
Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
CVE-2020-19511
PUBLISHED: 2021-06-21
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
CVE-2021-21422
PUBLISHED: 2021-06-21
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however ...
CVE-2021-0532
PUBLISHED: 2021-06-21
In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185196177