Input validation error in Microsoft Windows and Windows Server - CVE-2020-0993

Vulnerability identifier: #VU26853

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-0993

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the Windows DNS fails to properly handle queries. A remote authenticated attacker can send malicious DNS queries and perform a denial of service (DoS) attack.

Microsoft Windows
Windows Server
Solutions Enabler Virtual Appliance
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax

Install updates from vendor's website.

Solutions Enabler Virtual Appliance - addressed in versions 9.0.0.19, 9.1.0.6
Solutions Enabler - addressed in versions 9.0.0.19, 9.1.0.6
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.0.2.18, 9.1.0.17
Unisphere for PowerMax - addressed in versions 9.0.2.18, 9.1.0.17

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0993

• Denial of service in Microsoft Windows DNS
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler