CVE-2020-1228

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive. To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service. The update addresses the vulnerability by correcting how Windows DNS processes queries.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows Server version 2004	>= 10.0.0, < publication
Microsoft	Windows Server 2019	>= 10.0.0, < publication
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.0, < publication
Microsoft	Windows Server, version 1909 (Server Core installation)	>= 10.0.0, < publication
Microsoft	Windows Server, version 1903 (Server Core installation)	>= 10.0.0, < publication
Microsoft	Windows Server 2016	>= 10.0.0, < publication
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.0, < publication
Microsoft	Windows Server 2008 Service Pack 2	>= 6.0.0, < publication
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	>= 6.0.0, < publication
Microsoft	Windows Server 2008 Service Pack 2	>= 6.0.0, < publication
Microsoft	Windows Server 2008 R2 Service Pack 1	>= 6.1.0, < publication
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	>= 6.0.0, < publication
Microsoft	Windows Server 2012	>= 6.2.0, < publication
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.0, < publication
Microsoft	Windows Server 2012 R2	>= 6.3.0, < publication
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.0, < publication

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1228Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1228Patch, Vendor Advisory

Timeline

Published: Sep 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-122806.5iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php.CVE-2020-122816.5iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.CVE-2020-122828.8iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (Thi CVE-2020-122836.1Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/front CVE-2020-122849.8cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling be CVE-2020-122864.3In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped CVE-2020-122877.8Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentia CVE-2020-122885.5Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of se CVE-2020-122895.5Out-of-bounds write in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via CVE-2020-12294.3A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, a CVE-2020-122905.5Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service CVE-2020-122915.5Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial