Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

Bugtraq ID:	34013
Class:	Design Error
CVE:	CVE-2009-0094
Remote:	Yes
Local:	No
Published:	Mar 10 2009 12:00AM
Updated:	Mar 16 2009 12:36PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Terminal Services 0 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

The Microsoft Windows WINS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD (Web Proxy Autodiscovery Protocol) and ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) entries.

An authenticated attacker may exploit this issue to create a WPAD or ISATAP WINS entry. This may aid in man-in-the-middle and spoofing attacks. Other attacks are also possible.

Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

An attacker may exploit this issue using readily available tools.

Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=049e5db5-7315 -4188-99fd-4a54833e6bf2

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=049e5db5-7315 -4188-99fd-4a54833e6bf2

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=37e3a75e-0a5d -4df0-881f-cdb87efa4dcf

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=37e3a75e-0a5d -4df0-881f-cdb87efa4dcf

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=049e5db5-7315 -4188-99fd-4a54833e6bf2

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=37e3a75e-0a5d -4df0-881f-cdb87efa4dcf

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=049e5db5-7315 -4188-99fd-4a54833e6bf2

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=049e5db5-7315 -4188-99fd-4a54833e6bf2

Microsoft Windows Server 2003 x64 SP1

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=049e5db5-7315 -4188-99fd-4a54833e6bf2

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=37e3a75e-0a5d -4df0-881f-cdb87efa4dcf

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows 2000 Server SP4

• Microsoft Security Update for Windows 2000 (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4319abb3-1ea2 -466a-a815-c0b3b86b4462

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB961064)
  http://www.microsoft.com/downloads/details.aspx?familyid=4a393c63-eff5 -4c8c-9c3f-33ce45c32428

Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• MS09-008: DNS and WINS Server Security Update in More Detail (Microsoft)
  
• ASA-2009-083 MS09-008 Vulnerabilities in DNS and WINS Server (Avaya)
  
• Microsoft Security Bulletin MS09-008 (Microsoft)