QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2009-0093

Back to search

CVE-2009-0093

Published: Mar 11, 2009

Modified: Aug 7, 2024

PUBLISHED

Description

Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restrict registration of the "wpad" hostname, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) feature, and conduct man-in-the-middle attacks by spoofing a proxy server, via a Dynamic Update request for this hostname, aka "DNS Server Vulnerability in WPAD Registration Vulnerability," a related issue to CVE-2007-1692.

VendorProductVersions

n/a

n/a

affected
n/a

References

oval:org.mitre.oval:def:6138
vdb-entry
signature
x_refsource_OVAL
TA09-069A
third-party-advisory
x_refsource_CERT
ADV-2009-0661
vdb-entry
x_refsource_VUPEN
34217
third-party-advisory
x_refsource_SECUNIA
52519
vdb-entry
x_refsource_OSVDB
33989
vdb-entry
x_refsource_BID
MS09-008
vendor-advisory
x_refsource_MS
1021830
vdb-entry
x_refsource_SECTRACK

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now