CVE-2020-1228Improper Input Validation in Microsoft Windows Server 2008 R2 Service Pack 1

Severity
6.5MEDIUMNVD
EPSS
14.1%
top 5.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 11
Latest updateMar 7

Description

A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive. To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service. The update addresses the vulnerability by correcting how Windows DNS processes queries.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Patches

🔴Vulnerability Details

2
GHSA
GHSA-pf2q-6q6p-25p9: A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, aka 'Windows DNS Denial of Service Vulnerability'2022-05-24
GHSA
GHSA-h78g-2jmr-346w: A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, aka 'Windows DNS Denial of Service Vulnerability'2022-05-24

📋Vendor Advisories

2
Chrome
Stable Channel Update for Desktop: CVE-2023-12282023-03-07
Microsoft
Windows DNS Denial of Service Vulnerability2020-09-08

🕵️Threat Intelligence

4
Trendmicro
September Patch Tuesday Updates Exchange, SharePoint2020-09-09
Trendmicro
September Patch Tuesday Updates Exchange, SharePoint2020-09-09
Trendmicro
September Patch Tuesday Updates Exchange, SharePoint2020-09-09
Tenable
Microsoft’s September 2020 Patch Tuesday Addresses 129 CVEs2020-09-08

💬Community

1
Bugzilla
CVE-2020-6851 openjpeg: Heap-based buffer overflow in opj_t1_clbl_decode_processor()2020-01-13
CVE-2020-1228 — Improper Input Validation in Microsoft | cvebase