CVEvulnerability
CVE-2009-0234
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-03-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-20
Description
The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability."
Affected configurations
• microsoft windows 2000
• microsoft windows server 2003
• microsoft windows server 2008
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx blogs.technet.com
- http://osvdb.org/52518 osvdb.org
- http://secunia.com/advisories/34217 secunia.com
- http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm support.avaya.com
- http://www.kb.cert.org/vuls/id/319331 US Government Resource
- http://www.securityfocus.com/bid/33988 www.securityfocus.com
- http://www.securitytracker.com/id?1021831 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA09-069A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/0661 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5715 oval.cisecurity.org
- http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx blogs.technet.com
- http://osvdb.org/52518 osvdb.org
- http://secunia.com/advisories/34217 secunia.com
- http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm support.avaya.com
- http://www.kb.cert.org/vuls/id/319331 US Government Resource
- http://www.securityfocus.com/bid/33988 www.securityfocus.com
- http://www.securitytracker.com/id?1021831 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA09-069A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/0661 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5715 oval.cisecurity.org