Security News > 2020 > July > U.S. Government Agencies Instructed to Patch Wormable Windows Server Flaw

The US Cybersecurity and Infrastructure Security Agency has instructed government agencies to immediately address a vulnerability affecting Windows DNS servers.

The flaw, which impacts Windows Server versions released in the past 17 years, allows a remote, unauthenticated attacker to run arbitrary code on affected Windows DNS servers using specially crafted requests.

The Emergency Directive 20-03 issued by CISA on Thursday instructs federal agencies to take action as soon as possible to ensure that their servers are protected against attacks exploiting CVE-2020-1350.

Agencies have been given 24 hours to roll out either the patch or the workaround for SIGRed to all Windows DNS servers.

They have been given until July 24 to install the patch and remove the workaround, and until the same date they need to ensure that controls are in place so that newly provisioned servers, or ones that have been disconnected, are updated before they are connected to the government's networks.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/JMlFWSuF7Gg/us-government-agencies-instructed-patch-wormable-windows-server-flaw