PT-2007-5125 · Microsoft · Windows 2000 Server+1

Publicado

2007-11-14

·

Atualizado

2021-07-07

·

CVE-2007-3898

CVSS v2.0

6.4

Média

VetorAV:N/AC:L/Au:N/C:N/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Microsoft Windows 2000 Server version SP4 Microsoft Windows Server 2003 versions SP1 through SP2
Description: The issue concerns the DNS server in the affected Microsoft Windows versions, which uses predictable transaction IDs when querying other DNS servers. This predictability allows remote attackers to spoof DNS replies and poison the DNS cache, potentially facilitating further attack vectors.
Recommendations: For Microsoft Windows 2000 Server SP4, update to a newer service pack or version to mitigate the risk. For Microsoft Windows Server 2003 SP1, consider applying a patch or updating to SP3 or a later version. For Microsoft Windows Server 2003 SP2, consider applying a patch or updating to a later version.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2007-3898

Produtos afetados

Windows 2000 Server
Windows Server 2003