Microsoft Windows DNS Server WPAD Access Validation Vulnerability

Bugtraq ID:	33989
Class:	Design Error
CVE:	CVE-2009-0093
Remote:	Yes
Local:	No
Published:	Mar 10 2009 12:00AM
Updated:	May 11 2009 10:26PM
Credit:	Kevin Day, Dave Dagon, and Microsoft
Vulnerable:	Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Terminal Services 0 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Windows DNS Server WPAD Access Validation Vulnerability

The Microsoft Windows DNS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD (Web Proxy Autodiscovery Protocol) entries.

An authenticated attacker may exploit this issue to create a WPAD DNS entry. This may aid in man-in-the-middle and spoofing attacks. Other attacks are also possible.

Microsoft Windows DNS Server WPAD Access Validation Vulnerability

An attacker may exploit this issue using readily available tools.

Microsoft Windows DNS Server WPAD Access Validation Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 x64 SP1

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=6cc42c9e-c34e -4577-8b23-9e07e2369878

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3ed7d9a-d652 -4bd0-aecc-5a415bec6c59

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=110354f7-5ece -4c4d-b563-3adba6ac0116

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961063)
  http://www.microsoft.com/downloads/details.aspx?familyid=b1f81fd2-0099 -4450-8543-0459561d22d0

Microsoft Windows DNS Server WPAD Access Validation Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• MS09-008: DNS and WINS Server Security Update in More Detail (Microsoft)
  
• Successful Exploit Renders Microsoft Patch Ineffective (nCircle)
  
• ASA-2009-083 MS09-008 Vulnerabilities in DNS and WINS Server (Avaya)
  
• Microsoft Security Bulletin MS09-008 (Microsoft)