|
 |
|
Microsoft Windows DNS-Client Vorhersagbare Transaction-ID Sicherheitslücke
|
|
|
|
|
Secunia Advisory:
|
SA29696
|
|
|
Herausgegeben:
|
2008-04-08
|
|
Last Update:
|
2008-04-10
|
|
|
Gefahrenstufe:
|
Mittelgradig kritisch
|
|
Auswirkung:
|
Spoofing
|
|
Von Wo:
|
Aus dem Internet
|
|
Lösungsstatus:
|
Hersteller-Patch
|
|
| OS: | Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Vista
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
|
|
| | CVE reference: | CVE-2008-0087 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Beschreibung:
Eine Sicherheitslücke in Microsoft Windows wurde gemeldet, die böswillige Personen ausnutzen können, um den DNS-Cache zu manipulieren.
Die Sicherheitslücke besteht, da der Windows DNS-Client vorhersagbare Transaction-IDs in ausgehenden Anfragen verwendet. Dies kann ausgenutzt werden, um den DNS-Cache zu manipulieren, wenn die Transaction-ID erraten wird.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Lösung:
Verwenden Sie die Patches.
Windows 2000 SP4:
http://www.microsoft.com/downloads/de...=41326ade-96b6-47ce-9291-d4e3039471c4
Windows XP SP2:
http://www.microsoft.com/downloads/de...=893f4cef-0395-4c44-ba28-7a10b6e7dd48
Windows XP Professional x64 Edition (optional mit SP2):
http://www.microsoft.com/downloads/de...=8fdd1207-6e93-4c43-bacc-fe3623a6ebe7
Windows Server 2003 SP1/SP2:
http://www.microsoft.com/downloads/de...=214bd8f5-6eb2-414c-b013-c516a306d692
Windows Server 2003 x64 Edition (optional mit SP2):
http://www.microsoft.com/downloads/de...=fd123394-a5d6-4b55-be74-2938f52ce922
Windows Server 2003 mit SP1/SP2 für Itanium-basierte Systeme:
http://www.microsoft.com/downloads/de...=e0e63f03-904d-47ee-94fc-51a8dea668eb
Windows Vista:
http://www.microsoft.com/downloads/de...=8203d303-c855-4579-9bbf-b06ddf5c1b87
Windows Vista x64 Edition:
http://www.microsoft.com/downloads/de...=73f3a234-3973-4467-be7e-69efa7ee978c
Gemeldet und/oder entdeckt von:
Der Hersteller nennt:
* Amit Klein von Trusteer
* Alla Berzroutchko von Scanit
* Roy Arends von Nominet UK
Änderungen:
2008-04-10: Weiteren Link hinzugefügt.
Original Advisory:
MS08-020 (945553):
http://www.microsoft.com/technet/security/Bulletin/MS08-020.mspx
Amit Klein, Trusteer:
http://www.trusteer.com/docs/Microsoft_Windows_resolver_DNS_cache_poisoning.pdf
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
283 Related Secunia Security Advisories, displaying 10
|
|
|
1. Microsoft Windows Event System Erweiterung von Rechten
|
|
2. Microsoft Windows IPsec Verarbeitung von Richtlinien Preisgabe von Informationen
|
|
3. Microsoft Windows "Color Management System" Pufferüberlauf
|
|
4. Microsoft SQL Server und MSDE Mehrere Sicherheitslücken
|
|
5. Microsoft Windows Explorer gespeicherte Suche Sicherheitslücke
|
|
6. Microsoft Windows DNS-Spoofing Sicherheitslücken
|
|
7. Microsoft Windows Pragmatic General Multicast Denial of Service
|
|
8. Microsoft Windows Active Directory Verarbeitung von LDAP-Anfragen Denial of Service
|
|
9. Microsoft Windows WINS Rechteerweiterung
|
|
10. Microsoft DirectX MJPEG/SAMI Sicherheitslücken
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
