Windows DNS Service Bugs Let Remote Users Spoof the System
|
|
SecurityTracker Alert ID: 1020437
|
|
SecurityTracker URL: http://securitytracker.com/id?1020437
|
|
CVE Reference: CVE-2008-1447
, CVE-2008-1454
(Links to External Site)
|
Updated: Jul 25 2008
|
Original Entry Date: Jul 8 2008
|
Impact: Modification of system information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 2000 SP4, 2003 SP2, 2008; and prior service packs
|
Description: Two vulnerabilities were reported in the in Windows DNS client and Windows DNS server. A remote user can spoof the system.
The domain name system (DNS) service does not use sufficiently random DNS transaction ID values and random UDP sockets to process
queries [CVE-2008-1447]. A remote user can send specially crafted DNS queries and responses to the target service to spoof responses
and insert records into the DNS server or client cache. This may cause traffic on the target system to be redirected to arbitrary
IP addresses specified by the remote user.
Dan Kaminsky of IOActive reported this vulnerability.
Demonstration exploit code
is available at:
http://www.caughq.org/exploits/CAU-EX-2008-0002.txt
http://www.caughq.org/exploits/CAU-EX-2008-0003.txt
The
DNS service incorrectly accepts records from a response that is outside the remote server's authority [CVE-2008-1454]. A remote
user can send a specially crafted message in response to a request to poison the DNS cache on the target system. This may cause
traffic on the target system to be redirected to arbitrary IP addresses specified by the remote user.
|
Impact: A remote user can spoof the DNS service, causing traffic to be redirected to arbitrary hosts.
|
Solution: The vendor has issued fixes for both DNS client and DNS server software on the affected platforms.
A patch matrix is available
in the vendor's advisory.
A restart is required.
On July 10, 2008, Microsoft updated their advisory to include a FAQ entry
for users of ZoneAlarm and Check Point Endpoint Security, as those users may experience "an Internet connectivity issue" after updating.
On
July 25, 2008, Microsoft issued a separate advisory (http://www.microsoft.com/technet/security/advisory/956187.mspx) warning that
exploit code for CVE-2008-1447 is publicly available.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms08-037.mspx
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS08-037.mspx (Links to External Site)
|
Cause: Access control error, Randomization error
|
Underlying OS: Windows (2000), Windows (2003), Windows (2008)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 8 Jul 2008 12:48:27 -0400
Subject: Microsoft Security Bulletin MS08-037 Important: Vulnerabilities in DNS Could Allow Spoofing (953230)
|
http://www.microsoft.com/technet/security/bulletin/ms08-037.mspx
CVE-2008-1447
CVE-2008-1454
|
|
