Microsoft DNS Server Bugs Let Remote Users Spoof the DNS Service
|
|
SecurityTracker Alert ID: 1021831 |
|
SecurityTracker URL: http://securitytracker.com/id/1021831
|
|
CVE Reference:
CVE-2009-0233, CVE-2009-0234
(Links to External Site)
|
Date: Mar 10 2009
|
Impact:
Modification of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2000 SP4, 2003 SP2, 2008; and prior service packs
|
Description:
Two vulnerabilities were reported in Microsoft DNS Server. A remote user can spoof the DNS.
The Windows DNS server does not reuse cached responses when receiving specifically crafted queries. As a result, subsequent transaction IDs used by the DNS server can be more readily predicted [CVE-2009-0233].
The Windows DNS server does not properly cache specially crafted DNS responses. As a result, subsequent transaction IDs used by the DNS server can be more readily predicted [CVE-2009-0234].
A remote user may be able to exploit these vulnerabilities to insert arbitrary addresses into the DNS cache.
Kevin Day and Dave Dagon reported these vulnerabilities.
|
Impact:
A remote user can spoof the DNS service.
|
Solution:
The vendor has issued the following fixes:
DNS server on Microsoft Windows 2000 Server Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?familyid=110354f7-5ece-4c4d-b563-3adba6ac0116
DNS server on Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e-4577-8b23-9e07e2369878
DNS server on Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099-4450-8543-0459561d22d0
DNS server on Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652-4bd0-aecc-5a415bec6c59
DNS server on Windows Server 2008 for 32-bit Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=92e89882-d656-4b61-a05c-3afb44895f08
DNS server on Windows Server 2008 for x64-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=be068d06-5939-4ad8-8191-e85931ed610f
A restart is required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms09-008.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms09-008.mspx (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
