\n The Microsoft Patch Tuesday release for July 14, 2020 contains (123) reported disclosures. This month’s release has one critical vulnerability in Microsoft Windows Server (CVE-2020-1350) that allows for remote code execution by an unauthenticated attacker. It also has been confirmed by Microsoft to be wormable; devoid of user interaction.\n<\/p>\n
\n \n<\/p>\n
\n \n Microsoft Windows Server can be attacked by an unauthenticated attacker sending malicious DNS requests to a Windows DNS server. The vulnerability results from a flaw in Microsoft’s DNS server role implementation and affects all Windows Server versions. The vulnerability potentially allows for an attacker to run arbitrary code as a Local System Account. Because the Windows DNS service is running as SYSTEM, an attacker can obtain Domain Administrator rights and ultimately gain elevated privileges; resulting in the potential compromise of an organization.\n<\/p>\n \n \n \n Windows Server 2019\n<\/p>\n \n Windows Server 2019 (Server Core installation)\n<\/p>\n \n Windows Server, version 1909 (Server Core installation)\n<\/p>\n \n Windows Server, version 1903 (Server Core installation)\n<\/p>\n \n Windows Server, version 2004 (Server Core installation)\n<\/p>\n \n Windows Server 2016\n<\/p>\n \n Windows Server 2016 (Server Core installation)\n<\/p>\n \n Windows Server 2008 for 32-bit Systems Service Pack 2\n<\/p>\n \n Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)\n<\/p>\n \n Windows Server 2008 for x64-based Systems Service Pack 2\n<\/p>\n \n Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)\n<\/p>\n \n Windows Server 2008 R2 for x64-based Systems Service Pack 1\n<\/p>\n \n Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)\n<\/p>\n \n Windows Server 2012\n<\/p>\n \n Windows Server 2012 (Server Core installation)\n<\/p>\n \n Windows Server 2012 R2\n<\/p>\n \n Windows Server 2012 R2 (Server Core installation)\n<\/p>\n\n \n \n \n Yes. This is a Microsoft Windows Server specific issue specific to Windows platforms.\n<\/p>\n\n \n \n \n No. Only Microsoft Windows Server versions are affected.\n<\/p>\n\n \n \n \n No. Microsoft has not observed in the wild attacks exploiting CVE-2020-1350.\n<\/p>\n \n \n<\/p>\n \n \n Because it has a CVSS score of 10 (Common Vulnerability Scoring System) and its possible wormable impact, FortiGuard Labs suggests that customers running affected Windows Server versions apply this month’s updates as soon as possible. If not possible, it is recommended that those affected perform the necessary workarounds steps outlined by Microsoft below:\n<\/p>\n\n \n \n The following registry modification has been identified as a workaround for this vulnerability.\n<\/p>\n\n \n HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesDNSParameters\n<\/p>\n \n DWORD = TcpReceivePacketSize\n<\/p>\n \n Value = 0xFF00\n<\/p>\n \n Note: A restart of the DNS Service is required to take effect.\n<\/p>\n
\n
\n What are the specifics of the vulnerability?
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n What versions of software are affected?
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n Is this issue Windows Server (and Microsoft) specific?
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n Is the Microsoft Windows DNS client vulnerable to this issue?
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n Have there been reports of in the wild exploitation?
\n <\/strong>
\n <\/span>\n<\/p>\n
\n
\n Any suggestions or mitigation\/workarounds?
\n <\/strong>
\n <\/span>\n<\/p>\n
\n Workarounds
\n <\/span>\n<\/p>\n