CVE-2009-0233

Published: Mar 11, 2009Modified: Apr 23, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not reuse cached DNS responses in all applicable situations, which makes it easier for remote attackers to predict transaction IDs and poison caches by simultaneously sending crafted DNS queries and responses, aka "DNS Server Query Validation Vulnerability."

Affected (7)

Products: Microsoft: Windows 2000, Windows Server 2003, Windows Server 2008

3 products

Windows Server 2003

Windows Server 2008

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 2000	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (20)

http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx

Source: secure@microsoft.com

http://osvdb.org/52517

Source: secure@microsoft.com

http://secunia.com/advisories/34217

Source: secure@microsoft.com

http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm

Source: secure@microsoft.com

http://www.securityfocus.com/bid/33982

Source: secure@microsoft.com

http://www.securitytracker.com/id?1021831

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA09-069A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2009/0661

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6228

Source: secure@microsoft.com

http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/52517

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34217

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/33982

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021831

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-069A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2009/0661

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6228

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.