CVEvulnerability

CVE-2008-0087

7.5 HIGH Published 2008-04-08 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2008-04-08
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected]): 8.8 HIGH — AV:N/AC:M/Au:N/C:N/I:C/A:C
Weaknesses: CWE-330

Description

The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses.

Affected configurations

• microsoft windows 2000 • microsoft windows server 2003 • microsoft windows vista • microsoft windows xp

Related

Weakness · CWE (1)

CWE-330 Use of Insufficiently Random Values weakness

Referenced by CWE · observed example (1)

CWE-330 Use of Insufficiently Random Values weakness

References

http://marc.info/?l=bugtraq&m=120845064910729&w=2 Mailing List, Third Party Advisory
http://secunia.com/advisories/29696 Broken Link, Third Party Advisory
http://www.securityfocus.com/archive/1/490575/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/28553 Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1019802 Broken Link, Third Party Advisory, VDB Entry
http://www.trusteer.com/docs/windowsresolver.html Broken Link
http://www.us-cert.gov/cas/techalerts/TA08-099A.html Broken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1144/references Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-020 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5314 Broken Link, Third Party Advisory
http://marc.info/?l=bugtraq&m=120845064910729&w=2 Mailing List, Third Party Advisory
http://secunia.com/advisories/29696 Broken Link, Third Party Advisory
http://www.securityfocus.com/archive/1/490575/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/28553 Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1019802 Broken Link, Third Party Advisory, VDB Entry
http://www.trusteer.com/docs/windowsresolver.html Broken Link
http://www.us-cert.gov/cas/techalerts/TA08-099A.html Broken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1144/references Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-020 Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5314 Broken Link, Third Party Advisory