What you need to fibd this is effort and solid engineering, not genius. Which means the bug itself is fairly trivial and hence avoidable low hanging fruit. A code review or security should find this
This is pretty damning for microsoft and the software industry in general.
What changed was the internet. Before that, say until 1998, they could deliver shoddy code without much impact, and the underpowered machines required cutting a few corners. But it saddled them with a legacy of horrible code.
But they know better now. I'd expect them to audit code as critical as this somewhere between 2003 and now.
Also, integer overflows are something the processor could protect against. See e.g. the 'into' x86 insn. It got dropped because disinterest used in x64. If microsoft wanted, it could have added a compiler flag that injected into after every add. Compile system critical services with it. Intel would make sure into was optimized in their next processor. This would have reclassified almost all overflow bugs from code execution to dos, overnight. We took bigger performance hits for other security code in the past. Oh well, history took an other path.
> Today we released an update for CVE-2020-1350, a Critical Remote Code Execution (RCE) vulnerability in Windows DNS Server that is classified as a ‘wormable’ vulnerability and has a CVSS base score of 10.0. This issue results from a flaw in Microsoft’s DNS server role implementation and affects all Windows Server versions. Non-Microsoft DNS Servers are not affected.
To work around this vulnerability, make the following registry change to restrict the size of the largest inbound TCP-based DNS response packet that's allowed:
Subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
Value: TcpReceivePacketSize
Type: DWORD
Value data: 0xFF00
net stop dns && net start dns