Windows Updates Just Got Serious: You Have 24 Hours To Comply, Homeland Security Tells Federal Agencies
Windows Updates Just Got
Serious: You Have 24 Hours To Comply, Homeland Security Tells Federal Agencies
Davey Winder Senior
Contributor |Jul 17, 2020,06:54am EDT
I report and analyse breaking
cybersecurity and privacy stories
24 hours to update Windows
Server
The July 14 'Patch
Tuesday' security updates rolled out by Microsoft included one particularly
gnarly critical vulnerability. CVE-2020-1350 to
be formal, or SIGRed as
it has already become known, scored a "perfect" 10 under the Common
Vulnerability Scoring System (CVSS) for good reasons: it's wormable, easy to
exploit and likely to be exploited.
So likely to be exploited
that the U.S. Department of Homeland Security, Cybersecurity and Infrastructure
Security Agency (CISA) has issued an equally rare emergency
directive giving government agencies just 24 hours to update Windows
Server or apply other mitigations.
SIGRed was discovered by
researchers at Check Point and is a vulnerability within the Windows Domain
Name System (DNS) service implementation. Microsoft has confirmed that the
vulnerability affects all versions of Windows Server.
The wormable Windows
vulnerability could enable attackers to gain full administrator rights on a
network and achieve arbitrary code execution. Being wormable puts this
vulnerability right up there in terms of criticality with WannaCry and NotPetya
in that it has the potential to propagate without user interaction, and
propagate very rapidly indeed.
"Windows DNS Server is a
near-ubiquitous platform that often runs on multiple, highly sensitive machines
within an enterprise network," Katie Nickels, director of intelligence at
Red Canary, said, "meaning that there might be multiple instances of
Windows DNS Server offering a foothold in any given environment—and those
footholds may well offer an attacker a highly privileged level of access."
What does the CISA emergency
directive say?
Emergency directive
20-03 has been signed off by Christopher C. Krebs, the director of
CISA. Issued July 16, the directive says that CISA has "determined that
this vulnerability poses unacceptable significant risk to the Federal Civilian
Executive Branch," and therefore "requires an immediate and emergency
action." That action being that all endpoints running Windows Server
operating systems must be updated.
However, Windows updates just
got serious when you look at the timeframes laid out in this emergency
directive.
You have 24 hours to comply
Federal agencies that have
Windows Server operating the DNS role within the enterprise must apply the July
2020 Windows update, or the registry modification mitigation workaround that
Microsoft issued, by 2 p.m. EDT on July 17. That gives these organizations just
24 hours to comply.
Those agencies where Windows
Server is used but not for DNS must update or mitigate by 2 p.m. EDT on July
24.
The emergency directive
states that the requirements apply to Windows Servers in "any information
system, including information systems used or operated by another entity on
behalf of an agency, that collects, processes, stores, transmits, disseminates,
or otherwise maintains agency information."
While this directive itself
applies only to relevant U.S. Executive Branch departments and agencies, CISA
is strongly recommending that state and local governments follow the advice and
update as soon as possible. The same goes, frankly, for the private sector and
individuals running Windows Server.
Lamar Bailey, director of
security research and development at Tripwire, said, "CVE-2020-1350 is one
of the most serious vulnerabilities disclosed this year. It is time to burn the
midnight oil and get this patched ASAP."
Comments
Post a Comment