CVE-2009-0234 - The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability."

Back Back to CVE browser

MEDIUM

The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability."

Published Mar 11, 2009

6.4

MEDIUM

CVSS 2.0

EPSS 34.44%

Description

The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability."

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (11)

http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx
x_refsource_CONFIRM
http://osvdb.org/52518
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34217
third-party-advisoryx_refsource_SECUNIA
http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm
x_refsource_CONFIRM
http://www.kb.cert.org/vuls/id/319331
third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.securityfocus.com/bid/33988
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1021831
vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA09-069A.html
third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2009/0661
vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008
vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5715
vdb-entrysignaturex_refsource_OVAL

Link	Providers	Tags
http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx		x_refsource_CONFIRM
http://osvdb.org/52518		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34217		third-party-advisoryx_refsource_SECUNIA
http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm		x_refsource_CONFIRM
http://www.kb.cert.org/vuls/id/319331		third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.securityfocus.com/bid/33988		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1021831		vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA09-069A.html		third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2009/0661		vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008		vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5715		vdb-entrysignaturex_refsource_OVAL