CVE-2020-0856: Active Directory Information Disclosure Vulnerability
CVE-2020-0856 is an information disclosure vulnerability in Active Directory, rated Important by Microsoft, with a CVSS 3.0 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 3.90% probability of exploitation activity in the next 30 days, higher than 90% of all scored vulnerabilities. Microsoft released the fix on 8 September 2020 in the September 2020 Patch Tuesday, delivered through 12 security updates (KB4570333, KB4574727, KB4571756, KB4577015 and more). It affects 17 products in 1 product family (Other).
Key facts
- CVE ID
- CVE-2020-0856
- Severity
- Medium CVSS 6.5
- Microsoft severity
- Important
- Impact
- Information Disclosure
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- More Likely
- Weakness
- CWE-200
- EPSS
- 3.90% (percentile 90%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- September 2020 Patch Tuesday
- Product families
- Other
CVSS score and vector
Microsoft scores CVE-2020-0856 at 6.5 (temporal 5.9) using CVSS 3.0. Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | None |
| Availability impact | None |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
NVD scores it 6.5 (MEDIUM) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Description
An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited this vulnerability would be able to read sensitive information about the target system.
To exploit this condition, an authenticated attacker would need to send a specially crafted request to the AD|DNS service. Note that the information disclosure vulnerability by itself would not be sufficient for an attacker to compromise a system. However, an attacker could combine this vulnerability with additional vulnerabilities to further exploit the system.
The update addresses the vulnerability by correcting how Active Directory integrated DNS (ADIDNS) handles objects in memory.
Frequently asked questions (Microsoft)
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is sensitive information.
Affected products (17)
Other
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| 11571 | KB4570333 | Security Update | Yes | |
| 11572 | KB4570333 | Security Update | Yes | |
| 11715 | KB4574727 | Security Update | Yes | |
| 11647 | KB4574727 | Security Update | Yes | |
| 11769 | KB4571756 | Security Update | Yes | |
| 10816 | KB4577015 | Security Update | Yes | |
| 10855 | KB4577015 | Security Update | Yes | |
| 9312 | KB4577064 KB4577070 | Monthly Rollup Security Only | Yes Yes | |
| 10287 | KB4577064 KB4577070 | Monthly Rollup Security Only | Yes Yes | |
| 9318 | KB4577064 KB4577070 | Monthly Rollup Security Only | Yes Yes | |
| 9344 | KB4577064 KB4577070 | Monthly Rollup Security Only | Yes Yes | |
| 10051 | KB4577051 KB4577053 | Monthly Rollup Security Only | Yes Yes | |
| 10049 | KB4577051 KB4577053 | Monthly Rollup Security Only | Yes Yes | |
| 10378 | KB4577038 KB4577048 | Monthly Rollup Security Only | Yes Yes | |
| 10379 | KB4577038 KB4577048 | Monthly Rollup Security Only | Yes Yes | |
| 10483 | KB4577066 KB4577071 | Monthly Rollup Security Only | Yes Yes | |
| 10543 | KB4577066 KB4577071 | Monthly Rollup Security Only | Yes Yes |
Security updates (12)
- KB4570333 (Security Update)
- KB4574727 (Security Update)
- KB4571756 (Security Update)
- KB4577015 (Security Update)
- KB4577064 (Monthly Rollup)
- KB4577070 (Security Only)
- KB4577051 (Monthly Rollup)
- KB4577053 (Security Only)
- KB4577038 (Monthly Rollup)
- KB4577048 (Security Only)
- KB4577066 (Monthly Rollup)
- KB4577071 (Security Only)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 6.5 (MEDIUM)
- NVD weakness
- CWE-200
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows server 2008 (x64) | all listed versions |
| windows server 2008 (x86) | all listed versions |
| windows server 2012 | all listed versions |
| windows server 2012 r2 | all listed versions |
| windows server 2016 | all listed versions |
| windows server 2016 1903 | all listed versions |
| windows server 2016 1909 | all listed versions |
| windows server 2016 2004 | all listed versions |
| windows server 2019 | all listed versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0856 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0856 (Patch, Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |