CVE-2009-0233: Input Validation
The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not reuse cached DNS responses in all applicable situations, which makes it easier for remote attackers to predict transaction IDs and poison caches by simultaneously sending crafted DNS queries and responses, aka "DNS Server Query Validation Vulnerability."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable dynamic updates on affected DNS servers (i.e., turn off Dynamic updates for the DNS zones) to prevent the DNSCache behavior that allows easier prediction of transaction IDs and cache poisoning.
Windows DNS Server (DNS Resolver Cache Service / DNSCache) dynamic updates = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0233?
CVE-2009-0233 is considered to have a moderate severity due to potential exploitation by remote attackers.
How do I fix CVE-2009-0233?
To mitigate CVE-2009-0233, it is recommended to apply the latest security updates from Microsoft.
What systems are affected by CVE-2009-0233?
CVE-2009-0233 affects Microsoft Windows 2000 SP4, Windows Server 2003 SP1 and SP2, and Windows Server 2008.
What type of vulnerability is CVE-2009-0233?
CVE-2009-0233 is a cache management vulnerability in the DNS Resolver Cache Service of Windows DNS Server.
Can CVE-2009-0233 lead to further attacks?
Yes, CVE-2009-0233 can potentially allow remote attackers to predict transactional responses, leading to further attacks.