{"id":845,"date":"2020-07-15T09:20:07","date_gmt":"2020-07-15T13:20:07","guid":{"rendered":"https:\/\/increasec.com\/?p=845"},"modified":"2020-07-15T09:39:34","modified_gmt":"2020-07-15T13:39:34","slug":"microsoft-dns-remote-code-execution-and-work-around","status":"publish","type":"post","link":"https:\/\/increasec.com\/?p=845","title":{"rendered":"Microsoft DNS Remote Code Execution and work-around"},"content":{"rendered":"\n<p>KB4569509: Guidance for DNS Server Vulnerability CVE-2020-1350 by Microsoft gives the Registry entry to modify <a href=\"https:\/\/support.microsoft.com\/en-us\/help\/4569509\/windows-dns-server-remote-code-execution-vulnerability\">here <\/a><\/p>\n\n\n\n<p>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\DNS\\Parameters<br>TcpReceivePacketSize<br>Value = 0xFF00        (DWORD)<\/p>\n\n\n\n<p>Then restart the DNS service.<\/p>\n\n\n\n<p>What our friends at M$ don&#8217;t tell us anywhere in the article is what format the registry entry is supposed to be in.    <\/p>\n\n\n\n<p>Rapid7 confirms that it is in fact a DWORD value  <a href=\"https:\/\/blog.rapid7.com\/2020\/07\/14\/windows-dns-server-remote-code-execution-vulnerability-cve-2020-1350-what-you-need-to-know\/\">here<\/a><\/p>\n\n\n\n<p>To confirm, Regedit will show the decimal equivalent of FF00 to the right which is 65280.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>KB4569509: Guidance for DNS Server Vulnerability CVE-2020-1350 by Microsoft gives the Registry entry to modify here HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\DNS\\ParametersTcpReceivePacketSizeValue = 0xFF00 (DWORD) Then restart the DNS service. What our friends at M$&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-845","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/845","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=845"}],"version-history":[{"count":4,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/845\/revisions"}],"predecessor-version":[{"id":849,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/845\/revisions\/849"}],"wp:attachment":[{"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}