MS09-008: Vulnerabilities in DNS Server Could Allow Spoofing (961063) (uncredentialed check)

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The DNS server running on the remote host is vulnerable to DNS spoofing
attacks.

Description :

According to its self-reported version number, the Microsoft DNS Server
running on the remote host has the following vulnerabilities :

- An issue exists in installations where dynamic updates
are enabled and ISATAP and WPAD are not already
registered in DNS due to the lack of restricting
registration on the 'wpad' hostname. A remote,
authenticated attacker can exploit this issue to
perform a man-in-the-middle attack. (CVE-2009-0093)

- An issue exists that allows a remote, unauthenticated
attacker to quickly and reliably spoof responses and
insert records into the DNS server's cache.
(CVE-2009-0233)

- An issue exists in the DNS Resolver Cache Service due
to improper caching of DNS responses that could allow
a remote, unauthenticated attacker to predict
transaction IDs and poison caches by sending many
crafted DNS queries. (CVE-2009-0234)

These issues may allow remote attackers to redirect network traffic
intended for systems on the Internet to the attacker's own systems.

See also :

http://technet.microsoft.com/en-us/security/bulletin/ms09-008
http://www.nessus.org/u?62af2d1a

Solution :

Microsoft has released a set of patches for Windows 2000, 2003 and
2008.

Risk factor :

Medium / CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS Temporal Score : 4.7
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: DNS

Nessus Plugin ID: 72835 ()

Bugtraq ID: 33982
33988
33989

CVE ID: CVE-2009-0093
CVE-2009-0233
CVE-2009-0234