Microsoft Windows DNS Server Response Caching DNS Spoofing Vulnerability

Bugtraq ID:	33982
Class:	Design Error
CVE:	CVE-2009-0233
Remote:	Yes
Local:	No
Published:	Mar 10 2009 12:00AM
Updated:	Mar 16 2009 12:26PM
Credit:	Kevin Day and Dave Dagon
Vulnerable:	Microsoft Windows Server 2008 Standard Edition 0 Microsoft Windows Server 2008 for x64-based Systems 0 Microsoft Windows Server 2008 for 32-bit Systems 0 Microsoft Windows Server 2008 Enterprise Edition 0 Microsoft Windows Server 2008 Datacenter Edition 0 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Terminal Services 0 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Windows DNS Server Response Caching DNS Spoofing Vulnerability

The Microsoft Windows DNS Server is prone to a DNS-spoofing vulnerability because the software fails to properly reuse cached responses.

Successfully exploiting this issue allows remote attackers to spoof DNS replies, allowing them to redirect network traffic and to launch man-in-the-middle attacks.

Microsoft Windows DNS Server Response Caching DNS Spoofing Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows DNS Server Response Caching DNS Spoofing Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2008 for x64-based Systems 0

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=be068d06-5939 -4ad8-8191-e85931ed610f

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2008 Standard Edition 0

• Microsoft Security Update for Windows Server 2008 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=92e89882-d656 -4b61-a05c-3afb44895f08

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 x64 SP1

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2008 for 32-bit Systems 0

• Microsoft Security Update for Windows Server 2008 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=92e89882-d656 -4b61-a05c-3afb44895f08

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=110354f7-5ece -4c4d-b563-3adba6ac0116

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2008 Datacenter Edition 0

• Microsoft Security Update for Windows Server 2008 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=92e89882-d656 -4b61-a05c-3afb44895f08

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2008 Enterprise Edition 0

• Microsoft Security Update for Windows Server 2008 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=92e89882-d656 -4b61-a05c-3afb44895f08

Microsoft Windows DNS Server Response Caching DNS Spoofing Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• MS09-008: DNS and WINS Server Security Update in More Detail (Microsoft)
  
• ASA-2009-083 MS09-008 Vulnerabilities in DNS and WINS Server (Avaya)
  
• Microsoft Security Bulletin MS09-008 (Microsoft)