Published: 11/03/2009 Updated: 26/02/2019

CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8

VMScore: 490

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P

The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap" NetBIOS names, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) features, and conduct man-in-the-middle attacks by spoofing a proxy server or ISATAP route, by registering one of these names in the WINS database, aka "WPAD WINS Server Registration Vulnerability," a related issue to CVE-2007-1692.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows 2000
microsoft windows server 2008
microsoft windows server 2003

NVD-CWE-Other http://www.securitytracker.com/id?1021829 http://www.vupen.com/english/advisories/2009/0661 http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm http://secunia.com/advisories/34217 http://osvdb.org/52520 http://www.securityfocus.com/bid/34013 http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx http://www.us-cert.gov/cas/techalerts/TA09-069A.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6117 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-0094

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect