Saint SIGRed, Worm That Slept Seventeen Years in DNS

Patron of Windows DNS servers, domain controllers, and bugs that wait patiently.

Life

In July 2020 Sagi Tzadik of Check Point revealed SIGRed (CVE-2020-1350), a flaw in the Windows DNS server able to spread machine to machine like a worm. A crafted DNS response, with an oversized SIG record, overflowed the service and could lead to code execution with the highest privileges. The bug had lived in the code since 2003: seventeen years of sleep before waking, with the top severity score.

Prayer

O Saint SIGRed, who sleeps in the name servers until someone calls you, protect our DNS from responses that are too long. Amen.

How to celebrate

Celebrated by installing the July 2020 patch, applying the registry mitigation if needed, and updating the domain controllers first.

A worm asleep in the name wakes one day and eats you.