CVE-2020-0718: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-0718) was identified in Active Directory integrated DNS (ADIDNS) when it mishandles objects in memory. This vulnerability, discovered in 2020, affects various versions of Microsoft Windows Server systems. The vulnerability is also known as 'Active Directory Remote Code Execution Vulnerability' and is distinct from CVE-2020-0761 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires an authenticated attacker and can be exploited through network access with low attack complexity. The vulnerability affects multiple versions of Windows Server including Server 2008, 2012, 2016, and their respective R2 versions (NVD).

If successfully exploited, this vulnerability allows an authenticated attacker to execute arbitrary code in the context of the Local System Account. This gives the attacker significant control over the affected system, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability (NVD).

To exploit the vulnerability, an authenticated attacker could send malicious requests to an Active Directory integrated DNS (ADIDNS) server. The attack requires network access and authentication, but does not require user interaction (NVD, Rapid7).

Microsoft has released security updates to address this vulnerability. The update corrects how Active Directory integrated DNS (ADIDNS) handles objects in memory. Multiple patches have been released for different versions of Windows Server, including KB4577048, KB4577071, KB4577015, and KB4570333 (Rapid7).