PT-2008-3021 · Microsoft · Dns+3

Published 2008-07-08 · Updated 2019-02-26 · CVE-2008-1454

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft DNS versions in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008

Description The issue allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting records from a response that is outside the remote server's authority.

Recommendations For Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-1454

Affected Products

Dns

Windows 2000

Windows Server 2003

Windows Server 2008

References · 8

• http://vupen.com/english/advisories/2008/2019/references · Vendor Advisory
• http://secunia.com/advisories/30925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1454 · Security Note
• http://securityfocus.com/bid/30132 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-037 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA08-190A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5380 · Note
• http://securitytracker.com/id?1020437 · Note