CVE-2020-1228
Last modified
CVE-2020-1228 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. <p>A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive.</p> <p>To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service.</p> <p>The update addresses the vulnerability by correcting how Windows DNS processes queries.</p>. EPSS estimates a 4.50% chance of exploitation in the next 30 days.
Description
<p>A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive.</p> <p>To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service.</p> <p>The update addresses the vulnerability by correcting how Windows DNS processes queries.</p>
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Windows Server 2008 | All versions | Sp2 |
| Microsoft | Windows Server 2008 | r2 | Sp1 |
| Microsoft | Windows Server 2012 | All versions | — |
| Microsoft | Windows Server 2012 | r2 | — |
| Microsoft | Windows Server 2016 | All versions | — |
| Microsoft | Windows Server 2016 | 1903 | — |
| Microsoft | Windows Server 2016 | 1909 | — |
| Microsoft | Windows Server 2016 | 2004 | — |
| Microsoft | Windows Server 2019 | All versions | — |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1228Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1228Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1228?
How severe is CVE-2020-1228?
How do I fix CVE-2020-1228?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-12274In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback…9.8
- CVE-2020-12275GitLab 12.6 through 12.9 is vulnerable to a privilege escala…5.3
- CVE-2020-12276GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an …4.8
- CVE-2020-12277GitLab 10.8 through 12.9 has a vulnerability that allows som…5.3
- CVE-2020-12278An issue was discovered in libgit2 before 0.28.4 and 0.9x be…9.8
- CVE-2020-12279An issue was discovered in libgit2 before 0.28.4 and 0.9x be…9.8
- CVE-2020-12280iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
- CVE-2020-12281iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
- CVE-2020-12282iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca par…8.8
- CVE-2020-12283Sourcegraph before 3.15.1 has a vulnerable authentication wo…6.1
- CVE-2020-12284cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4…9.8
- CVE-2020-12286In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12…4.3
Are you affected by CVE-2020-1228?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST