What is cve-2020-1350?

CVE-2020-1350, also known as SIGRed, is a critical remote code execution vulnerability affecting Windows Domain Name System (DNS) servers. This vulnerability occurs when the servers fail to properly handle requests, potentially allowing attackers to run arbitrary code in the context of the Local System Account. The affected systems include various versions of Microsoft Windows Server, posing a significant risk to organizations relying on these servers for their DNS infrastructure. It is crucial for organizations to address this vulnerability to ensure the security of their systems and networks.

Who is impacted by this?

The CVE-2020-1350 vulnerability, also known as SIGRed, affects users of Windows Domain Name System (DNS) servers. This remote code execution vulnerability impacts various versions of Microsoft Windows Server, including 2008 SP2, 2008 R2 SP1 (x64), 2012, 2012 R2, 2016, 2016 1903, 2016 1909, 2016 2004, and 2019. Organizations relying on these servers for their DNS infrastructure are at risk and should be aware of this significant security concern.

What to do if cve-2020-1350 affected you

If you're affected by the CVE-2020-1350 vulnerability, it's crucial to take immediate action to secure your systems. To mitigate this vulnerability, follow these steps:

1. Apply patches and updates provided by Microsoft for the affected Windows Server versions.

2. As an alternative, modify the registry as described in the Microsoft support article and restart the DNS Service.

3. Stay informed about known exploited vulnerabilities by regularly checking the CISA catalog.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2020-1350 vulnerability, also known as Microsoft Windows DNS Server Remote Code Execution Vulnerability, is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on November 3, 2021, with a due date of July 24, 2020.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as Insufficient Information, indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For a comprehensive understanding of CVE-2020-1350, including its description, severity, technical details, and known affected software configurations, visit the NVD page or explore the resources listed below.

• SIGRed Windows DNS Denial Of Service ≈ Packet Storm

• CVE-2020-1350 - Security Update Guide - Microsoft - Windows DNS Server Remote Code Execution Vulnerability

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog