Microsoft Security Bulletin MS09-008 - Important

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• Sites using SSL/TLS are not affected by this vulnerability.

Microsoft has not identified any workarounds for this vulnerability.

What is the scope of the vulnerability? 
A spoofing vulnerability exists in Windows DNS server. An attacker who successfully exploited this vulnerability could insert arbitrary addresses into the DNS cache.

What causes the vulnerability? 
Windows DNS server does not cache specific responses to specially crafted queries, thereby allowing greater predictability of subsequent transaction IDs used by the DNS server.

What is the Domain Name System (DNS)? 
Domain Name System (DNS) is one of the industry-standard suite of protocols that comprise TCP/IP. DNS is implemented using two software components: the DNS server and the DNS client (or resolver). Both components are run as background service applications. Network resources are identified by numeric IP addresses, but these IP addresses are difficult for network users to remember. The DNS database contains records that map user-friendly alphanumeric names for network resources, such as www.microsoft.com, to the IP addresses used by those resources for communication. In this way, DNS acts as a mnemonic device, making network resources easier to remember for network users. For more information and to view logical diagrams illustrating how DNS fits with other Windows technologies, review the article what is DNS.

What is DNS Cache? 
Domain Name System (DNS) caching resolver service is a service that saves the responses to DNS queries so that the DNS server is not repeatedly queried for the same information. For more information, see the DNSCache TechNet article or the DNS Resolver Cache Service TechNet article. See the Attack detection TechNet article for more information on DNS cache poisoning.

What might an attacker use the vulnerability to do? 
An attacker who has successfully exploited this vulnerability can insert arbitrary addresses into the DNS cache, also known as DNS cache poisoning.

How could an attacker exploit the vulnerability? 
An attacker could send specific queries to a vulnerable DNS server and at the same time respond back in a manner that allows the attacker to insert false or misleading DNS data. The attacker could then redirect Internet traffic from legitimate locations to an address of the attacker’s choice.

What systems are primarily at risk from the vulnerability? 
Windows DNS servers are at risk from this vulnerability.

What does the update do? 
The update removes this vulnerability by correcting the way that Windows DNS server validates specifically crafted queries.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• Sites using SSL/TLS are not affected by this vulnerability.

Microsoft has not identified any workarounds for this vulnerability.

What is the scope of the vulnerability? 
A spoofing vulnerability exists in Windows DNS server. This vulnerability could allow a remote unauthenticated attacker to have greater predictability of transaction IDs used by the DNS server, and thus facilitate DNS cache poisoning and redirection of Internet traffic.

What causes the vulnerability? 
Windows DNS server does not correctly cache specially crafted DNS responses. This results in the DNS server making unnecessary lookups and leads to greater predictability of subsequent transaction IDs used by the DNS server.

What is the Domain Name System (DNS)? 
Domain Name System (DNS) is one of the industry-standard suite of protocols that comprise TCP/IP. DNS is implemented using two software components: the DNS server and the DNS client (or resolver). Both components are run as background service applications. Network resources are identified by numeric IP addresses, but these IP addresses are difficult for network users to remember. The DNS database contains records that map user-friendly alphanumeric names for network resources, such as www.microsoft.com, to the IP addresses used by those resources for communication. In this way, DNS acts as a mnemonic device, making network resources easier to remember for network users. For more information and to view logical diagrams illustrating how DNS fits with other Windows technologies, review the article what is DNS.

What is DNS Cache? 
Domain Name System (DNS) caching resolver service is a service that saves the responses to DNS queries so that the DNS server is not repeatedly queried for the same information. For more information, see the DNSCache TechNet article or the DNS Resolver Cache Service TechNet article. See the Attack detection TechNet article for more information on DNS cache poisoning.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability in conjunction with other DNS cache vulnerabilities could poison the DNS cache and redirect internet traffic.

How could an attacker exploit the vulnerability? 
An attacker who successfully exploited this vulnerability could send multiple specifically crafted queries to the DNS server. As a result, the DNS server would make unnecessary lookups and thereby allow for greater predictability of subsequent transaction IDs used by the server.

What systems are primarily at risk from the vulnerability? 
Windows DNS servers are at risk from this vulnerability.

What does the update do? 
The update removes this vulnerability by correcting the way that Windows DNS servers cache and validate responses.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through responsible disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation.

• If WPAD and ISATAP is already registered on DNS it will not be possible for an attacker to register WPAD as well.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Create a WPAD.DAT Proxy Auto Configuration File on a Host Named WPAD in Your Organization to Direct Web Browsers to Your Organization’s Proxy

  To create a WPAD.DAT proxy auto configuration file, follow these steps:

  1. Create a WPAD.DAT file that adheres to the Proxy auto-config specification. For more information on Proxy Auto-Configuration (PAC) files including a sample file, see the following MSDN article.
  2. Place the WPAD.DAT file in the root directory of a web server in your organization and ensure the file can be requested anonymously.
  3. Create a MIME type for the WPAD.DAT file on the web server of "application/x-ns-proxy-autoconfig".
  4. Create the appropriate entries in your organizations DHCP or DNS server to allow discovery of the WPAD server.

  For information on how to register WPAD, see Microsoft Knowledgebase Article 934864.

  Impact of workaround. None

What is the scope of the vulnerability? 
A spoofing vulnerability exists in Windows DNS server. An attacker who successfully exploited this vulnerability could redirect Internet traffic.

What causes the vulnerability? 
The Windows DNS server does not correctly validate who can register WPAD entries on the DNS server. By default a DNS server will allow any user to create a registration in the DNS database for WPAD if the name registration does not already exist.

What is Web Proxy Auto-Discovery (WPAD)? 
The Web Proxy Auto-Discovery (WPAD) feature enables web clients to automatically detect proxy settings without user intervention. The WPAD feature prepends the hostname "wpad" to the fully-qualified domain name and progressively removes subdomains until it finds a WPAD server answering the domain name. For more information, see WinHTTP AutoProxy Support.

What is the Domain Name System (DNS)? 
Domain Name System (DNS) is one of the industry-standard suite of protocols that comprise TCP/IP. DNS is implemented using two software components: the DNS server and the DNS client (or resolver). Both components are run as background service applications. Network resources are identified by numeric IP addresses, but these IP addresses are difficult for network users to remember. The DNS database contains records that map user-friendly alphanumeric names for network resources, such as www.microsoft.com, to the IP addresses used by those resources for communication. In this way, DNS acts as a mnemonic device, making network resources easier to remember for network users. For more information and to view logical diagrams illustrating how DNS fits with other Windows technologies, review the article what is DNS.

What is Dynamic Update? 
Dynamic update enables DNS client computers to register and dynamically update their resource records with a DNS server whenever changes occur. This reduces the need for manual administration of zone records, especially for clients that frequently move or change locations and use DHCP to obtain an IP address. For more information, see the dynamic update TechNet article.

What is ISATAP?
The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) provides IPv6 connectivity within an IPv4 Intranet. For information on ISATAP, see RFC4214: Intra-Site Automatic Tunnel Addressing Protocol (ISATAP).

What might an attacker use the vulnerability to do? 
An attacker who has successfully exploited this vulnerability could spoof the legitimate web proxy and intercept or redirect internet traffic.

How could an attacker exploit the vulnerability? 
If an attacker registers "WPAD" in the DNS database and points it to an IP address that the attacker controls, it would allow the attacker to conduct man-in-the-middle (MITM) attacks against any browsers configured to use WPAD to discover proxy server settings.

What systems are primarily at risk from the vulnerability? 
Windows DNS servers are at risk from the vulnerability.

What does the update do? 
The update removes this vulnerability by modifying the way that Windows DNS servers respond to WPAD name resolution requests.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2009-0093.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation.

• If WINS server already has WPAD and ISATAP registered than an attacker will not be able to register these as well.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Create a WPAD.DAT Proxy Auto Configuration File on a Host Named WPAD in Your Organization to Direct Web Browsers to Your Organization’s Proxy

  To create a WPAD.DAT proxy auto configuration file, follow these steps:

  1. Create a WPAD.DAT file that adheres to the Proxy auto-config specification. For more information on Proxy Auto-Configuration (PAC) files including a sample file, see the following MSDN article.
  2. Place the WPAD.DAT file in the root directory of a web server in your organization and ensure the file can be requested anonymously.
  3. Create a MIME type for the WPAD.DAT file on the web server of "application/x-ns-proxy-autoconfig".
  4. Create the appropriate entries in your organizations DHCP or DNS server to allow discovery of the WPAD server.

  For information on how to register WPAD, see Microsoft Knowledgebase Article 934864.

  Impact of workaround. None

What is the scope of the vulnerability? 
A spoofing vulnerability exists in Windows WINS server. An attacker who successfully exploited this vulnerability could redirect internet traffic.

What causes the vulnerability? 
The Windows WINS server does not correctly validate who can register WPAD or ISATAP entries on the WINS server. By default a WINS server will allow any user to create a registration in the WINS database for WPAD or ISATAP if the name registration does not already exist.

What is Web Proxy Auto-Discovery (WPAD)? 
The Web Proxy Auto-Discovery (WPAD) feature enables web clients to automatically detect proxy settings without user intervention. The WPAD feature prepends the hostname "wpad" to the fully-qualified domain name and progressively removes subdomains until it finds a WPAD server answering the domain name. For more information see WinHTTP AutoProxy Support.

What is WINS?
WINS was designed specifically to support NetBIOS over TCP/IP (NetBT). WINS is required for any environment in which users access resources that have NetBIOS names. If you do not use WINS in such a network, you cannot connect to a remote network resource by using its NetBIOS name unless you use Lmhosts files, and you might be unable to establish file and print sharing connections. For more information, see the WINS TechNet article.

What is ISATAP?
The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) provides IPv6 connectivity within an IPv4 Intranet. For information on ISATAP, see RFC4214: Intra-Site Automatic Tunnel Addressing Protocol (ISATAP).

What might an attacker use the vulnerability to do? 
An attacker who has successfully exploited this vulnerability could spoof the legitimate web proxy or ISATAP route and intercept or redirect Internet traffic.

How could an attacker exploit the vulnerability? 
If an attacker registers WPAD or ISATAP in the WINS database and points it to an IP address they control, it would allow the attacker to conduct man-in-the-middle (MITM) attacks against any browsers configured to use WPAD to discover proxy server settings.

What systems are primarily at risk from the vulnerability? 
Windows WINS servers are at risk from the vulnerability.

What does the update do? 
The update removes this vulnerability by modifying the way that Windows WINS servers responds to WPAD and ISATAP name resolution requests.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed. It has been assigned Common Vulnerability and Exposure number CVE-2009-0094.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers and had not seen any examples of proof of concept code published when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.