cbcvebase.
CVE-2020-1350
published 2020-07-14

CVE-2020-1350: A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote…

PriorityP195critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
92.18%
99.8th percentile
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server_2008
microsoftwindows_server_2012
msrcwindows_server_2008_for_32-bit_systems_service_pack_2
msrcwindows_server_2008_for_x64-based_systems_service_pack_2
msrcwindows_server_2008_r2_for_x64-based_systems_service_pack_1
msrcwindows_server_2012
msrcwindows_server_2012_r2
msrcwindows_server_2016
msrcwindows_server_2019
msrcwindows_server_version_1903
msrcwindows_server_version_1909

Detection & IOCsextracted from sources · hover to see the quote

port53/UDP and 53/TCP
processdns.exe
otherWin32.Exploit.CVE-2020-1350
snort
SID 54509-54511, 54516-54518, 54521-54525, 54534, 54535
  • Monitor dns.exe for processing of oversized SIG resource records (>=64KB) over TCP — the vulnerability is triggered when a DNS response containing a SIG record with a signature field causing an integer overflow (result >65,535 bytes) is parsed by dns.exe!SigWireRead, leading to a heap buffer overflow.
  • Detect DNS TCP sessions where the 2-byte length prefix indicates a message approaching or at the 65,535-byte maximum — exploitation requires DNS-over-TCP (triggered via TC flag truncation fallback) to deliver the oversized SIG payload.
  • Look for DNS responses containing SIG (type 24) resource records with anomalously large RDATA/signature fields, particularly where the combined allocation formula for the record would exceed 65,535 bytes.
  • Monitor for dns.exe crashes or unexpected termination on Windows Server systems — a crash of dns.exe is an indicator of exploitation attempts against CVE-2020-1350.
  • ·A registry-based workaround exists that does not require restarting the server — it can be applied when immediate patching is not practical, but the official patch should be applied as soon as possible.
  • ·Only Windows DNS Server (dns.exe) is affected; non-Microsoft DNS server implementations are not vulnerable.
  • ·The vulnerability affects all Windows Server versions from 2003 to 2019; DNS servers are typically also domain controllers, making exploitation impact domain-wide.
  • ·Exploitation requires the attacker to control a malicious NS record that the victim DNS server is directed to query — direct exploitation without this redirection step (e.g., via a registered domain with a malicious NS) is the primary attack vector.

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_msrc10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.