Windows Updates Just Got Serious: You Have 24 Hours To Comply, Homeland Security Tells Federal Agencies


Windows Updates Just Got Serious: You Have 24 Hours To Comply, Homeland Security Tells Federal Agencies
Davey Winder Senior Contributor |Jul 17, 2020,06:54am EDT
I report and analyse breaking cybersecurity and privacy stories
24 hours to update Windows Server
The July 14 'Patch Tuesday' security updates rolled out by Microsoft included one particularly gnarly critical vulnerabilityCVE-2020-1350 to be formal, or SIGRed as it has already become known, scored a "perfect" 10 under the Common Vulnerability Scoring System (CVSS) for good reasons: it's wormable, easy to exploit and likely to be exploited.
So likely to be exploited that the U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA) has issued an equally rare emergency directive giving government agencies just 24 hours to update Windows Server or apply other mitigations.
SIGRed was discovered by researchers at Check Point and is a vulnerability within the Windows Domain Name System (DNS) service implementation. Microsoft has confirmed that the vulnerability affects all versions of Windows Server.
The wormable Windows vulnerability could enable attackers to gain full administrator rights on a network and achieve arbitrary code execution. Being wormable puts this vulnerability right up there in terms of criticality with WannaCry and NotPetya in that it has the potential to propagate without user interaction, and propagate very rapidly indeed.
"Windows DNS Server is a near-ubiquitous platform that often runs on multiple, highly sensitive machines within an enterprise network," Katie Nickels, director of intelligence at Red Canary, said, "meaning that there might be multiple instances of Windows DNS Server offering a foothold in any given environment—and those footholds may well offer an attacker a highly privileged level of access."
What does the CISA emergency directive say?
Emergency directive 20-03 has been signed off by Christopher C. Krebs, the director of CISA. Issued July 16, the directive says that CISA has "determined that this vulnerability poses unacceptable significant risk to the Federal Civilian Executive Branch," and therefore "requires an immediate and emergency action." That action being that all endpoints running Windows Server operating systems must be updated.
However, Windows updates just got serious when you look at the timeframes laid out in this emergency directive.
You have 24 hours to comply
Federal agencies that have Windows Server operating the DNS role within the enterprise must apply the July 2020 Windows update, or the registry modification mitigation workaround that Microsoft issued, by 2 p.m. EDT on July 17. That gives these organizations just 24 hours to comply.
Those agencies where Windows Server is used but not for DNS must update or mitigate by 2 p.m. EDT on July 24.
The emergency directive states that the requirements apply to Windows Servers in "any information system, including information systems used or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information."
While this directive itself applies only to relevant U.S. Executive Branch departments and agencies, CISA is strongly recommending that state and local governments follow the advice and update as soon as possible. The same goes, frankly, for the private sector and individuals running Windows Server.
Lamar Bailey, director of security research and development at Tripwire, said, "CVE-2020-1350 is one of the most serious vulnerabilities disclosed this year. It is time to burn the midnight oil and get this patched ASAP."

Comments

Popular posts from this blog

Report: World’s 1st remote brain surgery via 5G network performed in China

Facebook says hackers saw personal info of 14 million people

Too Much Power to the People? A Food Safety Site Tests the Limits