CVE-2007-3898

Sažetak

The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.

Reference

http://www.trusteer.com/docs/windowsdns.html
http://www.kb.cert.org/vuls/id/484649
http://www.securityfocus.com/bid/25919
http://www.securitytracker.com/id?1018942
http://secunia.com/advisories/27584
http://www.scanit.be/advisory-2007-11-14.html
http://www.us-cert.gov/cas/techalerts/TA07-317A.html
http://securityreason.com/securityalert/3373
http://www.vupen.com/english/advisories/2007/3848
https://exchange.xforce.ibmcloud.com/vulnerabilities/36805
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4395
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-062
http://www.securityfocus.com/archive/1/484186/100/0/threaded
http://www.securityfocus.com/archive/1/483698/100/0/threaded
http://www.securityfocus.com/archive/1/483635/100/0/threaded

CVSS

Base:	6.4
Impact:	4.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:N/I:P/A:P

Zadnje važnije ažuriranje

07-07-2021 - 16:09

Objavljeno

14-11-2007 - 01:46