Full Report
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of affected products contains multiple vulnerabilities related to the handling of DNS responses and requests. The most severe could allow an attacker to manipulate the DNS responses and cause a denial-of-service condition. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Analysis Summary
# Vulnerability: NAME:WRECK DNS Implementation Flaws in Siemens Products
## CVE Details
*Note: The "NAME:WRECK" set consists of 9 CVEs. Based on the provided context, the primary focus is on the vulnerabilities impacting Siemens DNS client implementations.*
* **CVE ID:** CVE-2020-25707 (and others including CVE-2020-11276, CVE-2020-11277)
* **CVSS Score:** Up to 7.5 (High)
* **CWE:** CWE-330 (Use of Insufficiently Random Values), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
## Affected Systems
* **Products:** Nucleus NET, Nucleus ReadyStart, and various Siemens Industrial products (e.g., SIMATIC, SINAMICS, SCALANCE) utilizing these TCP/IP stacks.
* **Versions:**
* Nucleus NET: All versions
* Nucleus ReadyStart: Versions prior to v4.1.1
* *Specific Siemens industrial hardware versions vary by product line; check Siemens SIRT for detailed device mapping.*
* **Configurations:** Devices with DNS clients enabled and configured to perform name resolution via external or untrusted DNS servers.
## Vulnerability Description
The "NAME:WRECK" vulnerabilities stem from implementation flaws in how DNS clients process DNS responses. Specifically, these flaws involve **DNS message compression**. When a DNS response is received, the client must decompress the message to read domain names. These implementations fail to properly validate the pointers or the bounds of the data during decompression, leading to memory corruption or infinite loops.
## Exploitation
* **Status:** Proof of Concept (PoC) available; no widespread exploitation in the wild reported at time of disclosure.
* **Complexity:** Medium (Requires the ability to intercept or spoof DNS responses).
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** Low (Potential for information leakage in specific memory corruption scenarios).
* **Integrity:** Medium (Potential manipulation of DNS responses/Cache poisoning).
* **Availability:** High (Denial-of-Service (DoS) via system crash or infinite loops).
## Remediation
### Patches
* **Nucleus ReadyStart:** Update to v4.1.1 or later.
* **Siemens Industrial Products:** Consult the Siemens ProductCERT for specific firmware updates for SIMATIC S7, SCALANCE, and SINAMICS families. Siemens has released staggered firmware updates for affected hardware.
### Workarounds
* **Disable DNS:** If name resolution is not critical, disable the DNS client on the affected devices.
* **Internal DNS Servers:** Restrict devices to only communicate with trusted, secure internal DNS servers.
* **Static Host Mapping:** Use static host files where possible to avoid DNS queries entirely.
## Detection
* **Indicators of Compromise:** Unexpected device reboots, failure of network services, or anomalous DNS traffic (unusually large DNS responses or malformed compression pointers).
* **Detection Methods:**
* Utilize Intrusion Detection Systems (IDS) with rules specifically designed to flag malformed DNS compression pointers.
* Monitor for "DNS record pointing to itself" or pointers jumping outside the current DNS packet boundaries.
## References
* Siemens ProductCERT Advisory: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-434032[.]pdf
* Forescout Research (NAME:WRECK): hxxps[://]www[.]forescout[.]com/blog/namewreck-breaking-the-domain-name-system-in-iot-ot-and-it-stacks/
* CISA Advisory (ICSA-21-103-04): hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-21-103-04