CVEvulnerability
CVE-2009-0233
5.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-03-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-20
Description
The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not reuse cached DNS responses in all applicable situations, which makes it easier for remote attackers to predict transaction IDs and poison caches by simultaneously sending crafted DNS queries and responses, aka "DNS Server Query Validation Vulnerability."
Affected configurations
• microsoft windows 2000
• microsoft windows server 2003
• microsoft windows server 2008
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx blogs.technet.com
- http://osvdb.org/52517 osvdb.org
- http://secunia.com/advisories/34217 secunia.com
- http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm support.avaya.com
- http://www.securityfocus.com/bid/33982 www.securityfocus.com
- http://www.securitytracker.com/id?1021831 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA09-069A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/0661 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6228 oval.cisecurity.org
- http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx blogs.technet.com
- http://osvdb.org/52517 osvdb.org
- http://secunia.com/advisories/34217 secunia.com
- http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm support.avaya.com
- http://www.securityfocus.com/bid/33982 www.securityfocus.com
- http://www.securitytracker.com/id?1021831 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA09-069A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/0661 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6228 oval.cisecurity.org