Security News > 2020 > July > Patch now! SIGRED – the wormable hole in your Windows servers
The good news for most of us, at least in terms of patching, is that this vulnerability only affects Windows servers, because the bug is in the Windows DNS server code, not in the Windows DNS client code.
DNS servers often need to perform client-like functions, for example by passing on requests that they can't answer themselves to other servers that can, reading in the replies and reformatting them to reply to the original client request that came in.
If not most, DNS servers - including the Windows DNS server - have code built into them that not only listens for requests but also processes reponses from other servers.
Having completely different implementations of the make-requests-and-process-replies code in the Windows DNS server program and the Windows DNS client software may sound unusual, but it is not surprising.
DNS servers typically need to handle a much broader set of possible DNS requests and replies than pure-play DNS clients, notably for exchanging data with other DNS servers.
News URL
Related news
- Microsoft 365 apps crash on Windows Server after Office update (source)
- Rsync vulnerabilities allow remote code execution on servers, patch quickly! (source)
- Windows Patch Tuesday hits snag with Citrix software, workarounds published (source)
- Microsoft fixes Office 365 apps crashing on Windows Server systems (source)
- Microsoft fixes Windows Server 2022 bug breaking device boot (source)
- 7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now (source)
- Microsoft issues out-of-band fix for Windows Server 2022 NUMA glitch (source)
- Don't want your Kubernetes Windows nodes hijacked? Patch this hole now (source)
- Microsoft fixes bug causing Windows Server 2025 boot errors (source)