Forum Discussion
Critical Remote Code Execution Flaw in Windows DNS Server...
Critical Remote Code Execution Flaw in Windows DNS Server Disclosed (CVE-2020-1350)
As part of the July Patch Tuesday, Microsoft patched a severe vulnerability in Windows DNS Server. CVE-2020-1350 is a remote code execution flaw in Windows DNS Server because the server handles certain DNS requests improperly.
CVE-2020-1350 was discovered by Check Point Research, who nicknamed this vulnerability “SIGRed.” It is rated critical, as it was assigned a CVSSv3 score of 10.0. Microsoft published their own blog post about the flaw, including a note that says this vulnerability is “wormable.”
For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.
5 Replies
Will the blog be updated with the 2 released plugins? Will those plugins be sharpened to reflect whether or not the registry key is set? Right now, credentialed check customers don't have one stop shopping to accurately identify vulnerable servers. Plugin 138554 has a dependency on a reg setting according to its documentation, plugin 138600 flags any server without the latest kernel regardless of the reg key workaround or whether the DNS role is installed, and the .audit only detects if the reg key workaround exists.
Hi @Regis P,
Thanks for reaching out to us. The plugins you mentioned are linked under the Identifying Affected Systems section under our standard language ("A list of Tenable plugins to identify this vulnerability will appear here as they’re released.") The plugins and audit file we've produced are several ways to identify affected systems or whether or not mitigations are in place. Since there are multiple avenues of detection, we don't currently have a single "one stop shopping" way to flag vulnerable servers. We are continuing to look into other methods of detection. If you'd like to make a formal request for additional plugin coverage, please reach out to our support team so we can have your request documented. -Satnam
Thanks for the reply. Satnam. I'm confused though -- do individual customers really have to formally request a reliable plugin without false positives or false negatives for a critical wormable RCE vulnerability? I can imagine a number of them feel that's really table stakes for credentialed vuln scanning.
