CVE

Id
37528  
CVE No.
CVE-2009-0093  
Status
Candidate  
Description
Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restrict registration of the "wpad" hostname, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) feature, and conduct man-in-the-middle attacks by spoofing a proxy server, via a Dynamic Update request for this hostname, aka "DNS Server Vulnerability in WPAD Registration Vulnerability," a related issue to CVE-2007-1692.  
Phase
Assigned (20090108)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
406980 37528 CVE-2009-0093 MISC:http://blog.ncircle.com/blogs/vert/archives/2009/03/successful_exploit_renders_mic.html  View
406981 37528 CVE-2009-0093 CONFIRM:http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx  View
406982 37528 CVE-2009-0093 CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm  View
406983 37528 CVE-2009-0093 MS:MS09-008  View
406984 37528 CVE-2009-0093 URL:http://www.microsoft.com/technet/security/Bulletin/MS09-008.mspx  View
406985 37528 CVE-2009-0093 CERT:TA09-069A  View
406986 37528 CVE-2009-0093 URL:http://www.us-cert.gov/cas/techalerts/TA09-069A.html  View
406987 37528 CVE-2009-0093 BID:33989  View
406988 37528 CVE-2009-0093 URL:http://www.securityfocus.com/bid/33989  View
406989 37528 CVE-2009-0093 OSVDB:52519  View
406990 37528 CVE-2009-0093 URL:http://osvdb.org/52519  View
406991 37528 CVE-2009-0093 OVAL:oval:org.mitre.oval:def:6138  View
406992 37528 CVE-2009-0093 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6138  View
406993 37528 CVE-2009-0093 SECTRACK:1021830  View
406994 37528 CVE-2009-0093 URL:http://www.securitytracker.com/id?1021830  View
406995 37528 CVE-2009-0093 SECUNIA:34217  View
406996 37528 CVE-2009-0093 URL:http://secunia.com/advisories/34217  View
406997 37528 CVE-2009-0093 VUPEN:ADV-2009-0661  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40053 JVNDB-2009-001059 Microsoft Office Visio におけるメモリ割り当てに関連する任意のコードを実行される脆弱性 Microsoft Office Visio には、Visio ファイルに対するメモリ割り当てを正しく検証しないため、任意のコードを実行される脆弱性が存在します。 CVE-2009-0097 37528 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001059.html  View