‘Wormable’ Flaw Leads July Microsoft Patches
Summary: Microsoft released fixes for 123 security holes in Windows and related software, including CVE-2020-1350, a critical wormable flaw in nearly all Windows Server versions that can be exploited by sending a specially crafted DNS request and carries a CVSS score of 10. Microsoft said it was not aware of active exploitation at publication, and the release also addressed 17 other critical flaws across Office, Internet Explorer, SharePoint, Visual Studio and .NET Framework.
What's compelling: Microsoft describes the DNS flaw as wormable and notes DNS is commonly installed on Domain Controllers, so a compromise could cause significant service interruptions and expose high-level domain accounts - and the same patch batch follows recent high-severity fixes for Citrix, F5, Juniper, Oracle and SAP while many teams are short-staffed and supporting remote work.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-1350CVE-2020-1410CVE-2020-1421CVE-2020-1435CVE-2020-1436CVE-2020-1463
- Related
- CVE-2020-1350: Microsoft Windows DNS Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021