SIGRed

{{Orphan|date=March 2022}}

SIGRed{{Cite web|url=https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/|title=SIGRed - Resolving Your Way into Domain Admin: Exploiting a 17 Year-old Bug in Windows DNS Servers|date=July 14, 2020|website=Check Point Research}} (CVE-[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1350 2020-1350]) is a security vulnerability discovered in Microsoft's Domain Name System (DNS) implementation of Windows Server versions from 2003 to 2019.

To exploit the vulnerability, an unauthenticated attacker sends malicious requests to a Windows DNS server.{{Cite web| title=Emergency Directive 20-03: Mitigate Windows DNS Server Remote Code Execution Vulnerability from July 2020 Patch | publisher=U.S. Department of Homeland Security | date=2020-07-16 | url=https://cyber.dhs.gov/assets/report/ed-20-03.pdf | archive-url=https://web.archive.org/web/20200716223116/https://cyber.dhs.gov/assets/report/ed-20-03.pdf | archive-date=2020-07-16}} If exploited, the vulnerability could allow an attacker to run arbitrary code on a Domain Controller in the context of the Local System Account.

In Microsoft's advisory of the issue, the vulnerability was classified 'wormable' and was given a CVSS base score of 10.0.{{Cite web|last=|first=|date=|title=July 2020 Security Update: CVE-2020-1350 Vulnerability in Windows Domain Name System (DNS) Server|url=https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/|archive-url=|archive-date=|access-date=2020-07-27|website=Microsoft Security Response Center|language=en-US}}

It has been the subject of a Department of Homeland Security emergency directive, instructing all government agencies to deploy patches or mitigations for it in 24 hours.{{Cite web|url=https://cyber.dhs.gov/ed/20-03/|title=cyber.dhs.gov - Emergency Directive 20-03|website=cyber.dhs.gov|date=16 July 2020 }}

The vulnerability was discovered by Check Point Software Technologies and publicly disclosed on July 14, 2020.