CVE-2007-3898

Microsoft Windows - Info Disclosure

Title source: llm

Description

The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Alla Berzroutchko · perlremotewindows

https://www.exploit-db.com/exploits/30636

View Code ZIP pw:eip

exploitdb SCANNER VERIFIED

by Alla Berzroutchko · perlremotewindows

https://www.exploit-db.com/exploits/30635

View Code ZIP pw:eip

References (15)

[Patch, Vendor Advisory] http://secunia.com/advisories/27584

[US Government Resource] http://www.kb.cert.org/vuls/id/484649

[Exploit, Patch] http://www.securityfocus.com/bid/25919

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1018942

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA07-317A.html

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-062

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/36805

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4395

[Various Sources] http://www.scanit.be/advisory-2007-11-14.html

[Various Sources] http://www.trusteer.com/docs/windowsdns.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/483635/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/483698/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/484186/100/0/threaded

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/3848

[Third Party Advisory] http://securityreason.com/securityalert/3373

Scores

EPSS 0.8637

EPSS Percentile 99.4%

Details

CWE

CWE-16

Status published

Products (3)

microsoft/windows_2000 (20 CPE variants)

microsoft/windows_2003_server (11 CPE variants)

microsoft/windows_server_2003 (3 CPE variants)

Published Nov 14, 2007

Tracked Since Feb 18, 2026