Nov 21 2007
Moderately critical Vulnerability in Microsoft Windows DNS Service
| Secunia Advisory: | SA27584 | |
| Release Date: | 2007-11-13 | |
| Last Update: | 2007-11-14 | |
| Critical: |  Moderately critical |
|
| Impact: | Spoofing | |
| Where: | From remote | |
| Solution Status: | Vendor Patch | |
| OS: | Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Server Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Web Edition |
|
| CVE reference: | CVE-2007-3898 (Secunia mirror) | |
| Description: A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to poison the DNS cache. The vulnerability is caused due to the DNS service (dns.exe) using predictable transaction values when sending out queries to upstream DNS servers. This can be exploited to poison the DNS cache via a specially crafted DNS response with a guessed transaction value when the DNS server performs a recursive lookup. Secunia has constructed the Online Software Inspector, which you can use to check if your local system is vulnerable. If you wish to scan your corporate network, then please refer to the Network Software Inspector. Solution: Microsoft Windows 2000 Server SP4: Windows Server 2003 SP1/SP2: Windows Server 2003 x64 Edition (optionally with SP2): Windows Server 2003 with SP1/SP2 for Itanium-based systems: Provided and/or discovered by: Changelog: Original Advisory: |
||
No responses yet
Leave a Reply
You must be logged in to post a comment.