CVE-2009-0094
First published: Wed Mar 11 2009(Updated: )
The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap" NetBIOS names, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) features, and conduct man-in-the-middle attacks by spoofing a proxy server or ISATAP route, by registering one of these names in the WINS database, aka "WPAD WINS Server Registration Vulnerability," a related issue to CVE-2007-1692.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows 2000 | =sp4 | |
| Microsoft Windows Server | ||
| Microsoft Windows Server | =sp1 | |
| Microsoft Windows Server | =sp1 | |
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | =sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securitytracker.com/id?1021829
- http://www.vupen.com/english/advisories/2009/0661
- http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm
- http://secunia.com/advisories/34217
- http://osvdb.org/52520
- http://www.securityfocus.com/bid/34013
- http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx
- http://www.us-cert.gov/cas/techalerts/TA09-069A.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6117
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008
Frequently Asked Questions
What is the severity of CVE-2009-0094?
CVE-2009-0094 is considered a high severity vulnerability due to the potential for remote authenticated users to hijack crucial network protocols.
How do I fix CVE-2009-0094?
To fix CVE-2009-0094, it is recommended to apply the latest security patches provided by Microsoft for vulnerable versions of Windows.
What systems are vulnerable to CVE-2009-0094?
CVE-2009-0094 affects Microsoft Windows 2000 SP4 and Windows Server 2003 SP1 and SP2.
What impact does CVE-2009-0094 have on network security?
CVE-2009-0094 can allow unauthorized access to web proxy auto-discovery and intra-site tunneling, compromising network confidentiality.
Is there a way to mitigate CVE-2009-0094 if immediate patching isn't possible?
To mitigate CVE-2009-0094, consider disabling the registration of 'wpad' and 'isatap' NetBIOS names until a patch can be applied.
- agent/type
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- agent/event
- agent/description
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/microsoft
- canonical/microsoft windows 2000
- version/microsoft windows 2000/sp4
- canonical/microsoft windows server
- version/microsoft windows server/sp1
- version/microsoft windows server/sp2