Signature Detail

DNS: Negative Response ANY Query

This signature detects negative responses for DNS type Any queries. A negative response for type Any could indicate a possible DNS poisoning attack resulting in unsuspected users being forced to view information that was unintended.

Extended Description

The Microsoft Windows DNS Server is prone to a DNS-spoofing vulnerability because the software fails to properly reuse cached responses. Successfully exploiting this issue allows remote attackers to spoof DNS replies, allowing them to redirect network traffic and to launch man-in-the-middle attacks.

Affected Products

• Avaya messaging_application_server MM 1.1
• Avaya messaging_application_server MM 2.0
• Avaya messaging_application_server MM 3.0
• Avaya messaging_application_server MM 3.1
• Avaya messaging_application_server
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server SP3
• Microsoft windows_2000_server SP4
• Microsoft windows_2000_server
• Microsoft windows_server_2003_datacenter_edition SP1
• Microsoft windows_server_2003_datacenter_edition
• Microsoft windows_server_2003_datacenter_edition_itanium SP1
• Microsoft windows_server_2003_datacenter_x64_edition SP2
• Microsoft windows_server_2003_datacenter_x64_edition
• Microsoft windows_server_2003_enterprise_edition SP1
• Microsoft windows_server_2003_enterprise_edition
• Microsoft windows_server_2003_enterprise_edition_itanium SP1
• Microsoft windows_server_2003_enterprise_x64_edition SP2
• Microsoft windows_server_2003_enterprise_x64_edition
• Microsoft windows_server_2003_itanium SP1
• Microsoft windows_server_2003_itanium SP2
• Microsoft windows_server_2003_itanium
• Microsoft windows_server_2003_standard_edition SP1
• Microsoft windows_server_2003_standard_edition SP2
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_standard_x64_edition
• Microsoft windows_server_2003_terminal_services
• Microsoft windows_server_2003_web_edition SP1
• Microsoft windows_server_2003_web_edition SP2
• Microsoft windows_server_2003_web_edition
• Microsoft windows_server_2003_x64 SP1
• Microsoft windows_server_2003_x64 SP2
• Microsoft windows_server_2008_datacenter_edition
• Microsoft windows_server_2008_enterprise_edition
• Microsoft windows_server_2008_for_32-bit_systems
• Microsoft windows_server_2008_for_x64-based_systems
• Microsoft windows_server_2008_standard_edition

References

• BugTraq: 33988
• CVE: CVE-2009-0233
• CVE: CVE-2009-0234
• URL: http://securitytnt.com/dns-amplification-attack/