CVE-2021-26897

Windows DNS Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26877, CVE-2021-26893, CVE-2021-26894, CVE-2021-26895.

Recent assessments:

architect00 at April 14, 2021 6:08am UTC reported:

Vulnerability Overview

0patch released a blog article about their micro patch concerning CVE-2021-26897. It describes the root cause as

> CVE-2021-26897 is a buffer overflow issue, whereby a series ofoversized “dynamic update” DNS queries with SIG (signature) recordscauses writing beyond the buffer boundarywhen these records are saved to file.

According to the blog article the record saves happen

• periodically or

• when the DNS service stops

The analysis of 0patch was based on an article from the McAfee Labs. They provided enough information to enable 0patch to gain understanding were the vulnerability is located.

Successful exploitation of this vulnerability results in running code with Local System privileges. A attacker does need a domain joined computer and have access to a DNS server. The configuration of the DNS server needs to haveDynamic Updates activated.

In an Active Directory environment Dynamic Updates are enabled by default. The default setting secure dynamic updates only allows domain joined computers to update a DNS zone.

Score reasoning

I rated the Attack Value pretty high. Successful exploitation provides adversaries with high privileged access to domain controllers.
The Exploitability score is based on the fact, that the vulnerability can be reversed through public resources and seems to be a buffer overflow. Nevertheless the broader mass of adversaries might be waiting for a detailed writeup or P-o-C and act opportunistic.

Sources:

• <https://blog.0patch.com/2021/03/analyzing-and-micropatching-with.html&gt;

• <https://www.mcafee.com/blogs/other-blogs/mcafee-labs/seven-windows-wonders-critical-vulnerabilities-in-dns-dynamic-updates/&gt;

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 3