|
| |
|
Security Intelligence Operations
Microsoft Windows DNS Service Cache Poisoning Vulnerability |
| |
| Vulnerability Alert | Powered by  |
|
|
| Threat Type: | Intercept/Monitoring/Traffic Analysis: Re-Route |
|
| IntelliShield ID: | 16178 |
| Version: | 1 |
| First Published: | July 08, 2008 04:17 PM EDT |
| Last Published: | July 08, 2008 04:17 PM EDT |
| Vector: | Network |
| Authentication: | None |
| Exploit: | Unproven |
| Port: |
Not Available
|
| CVE: | CVE-2008-1454 |
| BugTraq ID: | 30132 |
| |
| Urgency: |
Unlikely Use
|  |
| Credibility: |
Confirmed
|  |
| Severity: |
Mild Damage
|  |
| CVSS Base: | 4.3 |
CVSS Calculator
CVSS Version 2
|
| CVSS Temporal: | 3.2 |
|
|
| |
| Version Summary: | Microsoft Windows Server contains a vulnerability that could allow an unauthenticated, remote attacker to cause the storage of false IP addresses for requested names within the local DNS cache. Updates are available. |
| |
| |
| Description |
|
Microsoft Windows 2000 Server, Windows Server 2003 and Windows Server 2008 contain a vulnerability that could allow an unauthenticated, remote attacker to cause the storage of false IP addresses for valid domain names within the local DNS cache.
The vulnerability is due to errors in processing DNS requests. An unauthenticated, remote attacker could exploit the vulnerability by sending a malicious DNS reply to an affected system. If successful, the attacker could cause the DNS server to store the entry within the local DNS cache. This behavior could allow the attacker to perform subsequent attacks against systems reliant on the affected DNS servers, possibly to perform website spoofing, which is commonly used in phishing attacks.
Microsoft has confirmed the vulnerability and released updated software. |
| |
| Warning Indicators |
|
The following products are affected:
-
Windows 2000 Server SP and prior
-
Windows Server 2003 SP2 and prior
-
Windows Server 2003 x64 Edition SP2 and prior
-
Windows Server 2003 for Itanium-based Systems SP2 and prior
-
Windows Server 2008 for 32-bit Systems
-
Windows Server 2008 for x64-based Systems |
| |
| IntelliShield Analysis |
|
Only systems running the DNS server are affected by this vulnerability. An attacker could leverage an exploit of this vulnerability to conduct other attacks. By causing the server to store malicious DNS entries, the attacker could cause client systems requesting those entries to connect to malicious sites. The attacker may attempt to conduct phishing or spoofing attacks, or install malicious software on client systems.
The vulnerability appears to be related to the DNS Insufficient Entropy Vulnerability detailed in IntelliShield alert 16183.
Microsoft has corrected the vulnerability by introducing additional checks to properly validate the source of DNS requests. |
| |
| Vendor Announcements |
|
Microsoft has released a security bulletin at the following link: MS08-037 |
|
| |
| Impact |
|
An unauthenticated, remote attacker could exploit the vulnerability to cause affected systems to store DNS entries in local DNS caches, associating attacker-controlled IP addresses with valid or legitimate domain names. |
| |
| Technical Information |
|
The vulnerability is due to errors when processing DNS requests. The DNS service does not properly validate the source of DNS replies. As a result, the server may enter false entries into the DNS cache. The server may then report incorrect addresses to clients seeking name resolutions, directing dependent client systems to incorrect sites that could be controlled by an attacker. |
| |
| Safeguards |
|
Administrators are advised to apply the applicable software updates.
Administrators may consider disabling local DNS caches until updates can be applied.
Users are advised to utilize extra caution when an unexpected SSL security warning is presented for a trusted site.
Additional information about the Domain Name System, best practices, network protections, and attack identification for DNS is available in the following Cisco Applied Intelligence white paper: DNS Best Practices, Network Protections, and Attack Identification |
| |
| Patches/Software |
|
Microsoft has released updated software at the following links:
|
|
| |
| Alert History |
| |
Initial Release |
|
Product Sets |
| |
The security vulnerability applies to the following combinations of products.
|
|
LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME. |
|
|
| |
