SAD DNS is a protocol level vulnerability in the DNS system. Microsoft has published a new security advisory which offers a mitigation to protect your DNS systems from spoofing or poisoning.
If an attacker is able to successfully exploit the SAD DNS vulnerability (CVE-2020-25705), it will be possible to spoof a DNS packet which is then cached by the DNS Forwarder or the DNS Resolver. The result will be a change to the DNS entries for your website which could allow an attacker to divert traffic intended for your website to a server they control and perform a man in the middle attack or credential harvesting. The vulnerability exists in the DNS protocol itself, and so affects all supported version of Microsoft Servers from 2008 through to 20H2.
The Microsoft Security Advisory provides a registry-based mitigation which blocks the UDP packets that could be used to trigger the vulnerability forcing the DNS traffic to revert to TCP/IP which is not vulnerable to the attack. By applying the changes in the advisory, the UDP packet size is limited to 1221 bytes which will block any attempt to poison the DNS cache. This change is only a mitigation and not a cure for the underlying problem which also affects most operating systems including Linux, FreeBSD and macOS as well as stand alone DNS resolvers.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)