CVE-2009-0094: Medium severity Microsoft Windows 2000 vulnerability
The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap" NetBIOS names, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) features, and conduct man-in-the-middle attacks by spoofing a proxy server or ISATAP route, by registering one of these names in the WINS database, aka "WPAD WINS Server Registration Vulnerability," a related issue to CVE-2007-1692.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the WINS service/database to reserve or reject NetBIOS name registration requests for the names 'wpad' and 'isatap', so these names cannot be added to the WINS database.
WINS server (Microsoft Windows 2000 SP4 and Windows Server 2003 SP1/SP2) NetBIOS name registration = disallow registration of 'wpad' and 'isatap' - Compensating control
Restrict which hosts may perform WINS registrations and updates to authorized/trusted systems only (for example, enforce network ACLs or firewall rules limiting WINS update traffic to specific IPs), to prevent remote authenticated users from registering the 'wpad' or 'isatap' names.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0094?
CVE-2009-0094 is considered a high severity vulnerability due to the potential for remote authenticated users to hijack crucial network protocols.
How do I fix CVE-2009-0094?
To fix CVE-2009-0094, it is recommended to apply the latest security patches provided by Microsoft for vulnerable versions of Windows.
What systems are vulnerable to CVE-2009-0094?
CVE-2009-0094 affects Microsoft Windows 2000 SP4 and Windows Server 2003 SP1 and SP2.
What impact does CVE-2009-0094 have on network security?
CVE-2009-0094 can allow unauthorized access to web proxy auto-discovery and intra-site tunneling, compromising network confidentiality.
Is there a way to mitigate CVE-2009-0094 if immediate patching isn't possible?
To mitigate CVE-2009-0094, consider disabling the registration of 'wpad' and 'isatap' NetBIOS names until a patch can be applied.