Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
In a network-based attack an attacker would need to have the privileges to query the Domain Name Service (DNS). If the timing of DNS queries is perfect, the attacker could execute code remotely on the target server.
Security updates
10.0.17763.5696 — https://support.microsoft.com/help/5036896
10.0.20348.2402 — https://support.microsoft.com/help/5036909
10.0.25398.830 — https://support.microsoft.com/help/5036910
10.0.14393.6897 — https://support.microsoft.com/help/5036899
Vulnerabilities 1
-
High 7.2
Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2024-26233 Windows DNS Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26233
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss