Description
The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
References (1)
Core 1
Core References
Exploit x_refsource_misc
https://www.isc.org/files/imce/ghostdomain_camera.pdf
Scores
EPSS
0.1055
EPSS Percentile
95.3%
Details
Status
published
Products (2)
microsoft/windows_server_2008
(2 CPE variants)
microsoft/windows_server_2008
< -
Published
Feb 17, 2012
Tracked Since
Feb 18, 2026