CVE-2020-1228

EUVD-2020-12107

11.09.2020, 17:15

<p>A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive.</p>
<p>To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service.</p>
<p>The update addresses the vulnerability by correcting how Windows DNS processes queries.</p>

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
microsoft	CNA	7.5 HIGH				CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 94%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_server_2008	-
microsoft	windows_server_2012	-
microsoft	windows_server_2016	-
microsoft	windows_server_2019	-

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows Server

1903 Server Core	KB4574727
1909 Server Core	KB4574727
2004 Server Core	KB4571756

Windows Server 2008

Service Pack 2 (x64, x86)	KB4577070
Service Pack 2 Server Core (x64, x86)	KB4577070

Windows Server 2008 R2

Service Pack 1 (x64)	KB4577053
Service Pack 1 Server Core (x64)	KB4577053

Windows Server 2012

Server Core	KB4577048
Standard	KB4577048

Windows Server 2012 R2

Server Core	KB4577071
Standard	KB4577071

Windows Server 2016

Server Core	KB4577015
Standard	KB4577015

Windows Server 2019

Server Core	KB4570333
Standard	KB4570333

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1228