CoreCVE
Back

LOW

Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restrict registration of the "wpad" hostname, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) feature, and conduct man-in-the-middle attacks by spoofing a proxy server, via a Dynamic Update request for this hostname, aka "DNS Server Vulnerability in WPAD Registration Vulnerability," a related issue to CVE-2007-1692

Published Mar 11, 2009

Description

Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restrict registration of the "wpad" hostname, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) feature, and conduct man-in-the-middle attacks by spoofing a proxy server, via a Dynamic Update request for this hostname, aka "DNS Server Vulnerability in WPAD Registration Vulnerability," a related issue to CVE-2007-1692.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-20

Improper Input Validation

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner microsoft
Published Mar 11, 2009
Updated Aug 7, 2024
Reserved Jan 8, 2009
Link CVE-2009-0093
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2009-0093
Red Hat
Severity n/a
Public date n/a
Links CVE-2009-0093