Windows Updates Just Got Serious: You Have 24 Hours To Comply, Homeland Security Tells Federal Agencies
The July 14 ‘Patch Tuesday’ security updates rolled out by Microsoft included one particularly gnarly critical vulnerability. CVE-2020-1350 to be formal, or SIGRed as it has already become known, scored a “perfect” 10 under the Common Vulnerability Scoring System (CVSS) for good reasons: it’s wormable, easy to exploit and likely to be exploited.
Start a Homeland Security degree at American Military University.
So likely to be exploited that the U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA) has issued an equally rare emergency directive giving government agencies just 24 hours to update Windows Server or apply other mitigations.
Why is SIGRed so dangerous?
SIGRed was discovered by researchers at Check Point and is a vulnerability within the Windows Domain Name System (DNS) service implementation. Microsoft has confirmed that the vulnerability affects all versions of Windows Server.
The wormable Windows vulnerability could enable attackers to gain full administrator rights on a network and achieve arbitrary code execution. Being wormable puts this vulnerability right up there in terms of criticality with WannaCry and NotPetya in that it has the potential to propagate without user interaction, and propagate very rapidly indeed.
“Windows DNS Server is a near-ubiquitous platform that often runs on multiple, highly sensitive machines within an enterprise network,” Katie Nickels, director of intelligence at Red Canary, said, “meaning that there might be multiple instances of Windows DNS Server offering a foothold in any given environment—and those footholds may well offer an attacker a highly privileged level of access.”
What does the CISA emergency directive say?
Emergency directive 20-03 has been signed off by Christopher C. Krebs, the director of CISA. Issued July 16, the directive says that CISA has “determined that this vulnerability poses unacceptable significant risk to the Federal Civilian Executive Branch,” and therefore “requires an immediate and emergency action.” That action being that all endpoints running Windows Server operating systems must be updated.
However, Windows updates just got serious when you look at the timeframes laid out in this emergency directive.
You have 24 hours to comply
Federal agencies that have Windows Server operating the DNS role within the enterprise must apply the July 2020 Windows update, or the registry modification mitigation workaround that Microsoft issued, by 2 p.m. EDT on July 17. That gives these organizations just 24 hours to comply.
Those agencies where Windows Server is used but not for DNS must update or mitigate by 2 p.m. EDT on July 24.
The emergency directive states that the requirements apply to Windows Servers in “any information system, including information systems used or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information.”
While this directive itself applies only to relevant U.S. Executive Branch departments and agencies, CISA is strongly recommending that state and local governments follow the advice and update as soon as possible. The same goes, frankly, for the private sector and individuals running Windows Server.
Lamar Bailey, director of security research and development at Tripwire, said, “CVE-2020-1350 is one of the most serious vulnerabilities disclosed this year. It is time to burn the midnight oil and get this patched ASAP.”
Online Degrees & Certificates In Cybersecurity
American Military University's online cybersecurity programs integrate multiple disciplines to ensure you gain the critical skills and management practices needed to effectively lead cybersecurity missions – from government or private industry. Learn from the leader. American Military University is part of American Public University System, which has been designated by the National Security Agency and the Department of Homeland Security as a National Center of Academic Excellence in Cyber Defense Education.