NetSight
IP …
medium6.4Public exploit code

CVE-2007-3898

The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allow…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.

Affected products

VendorProductAffected versions
MicrosoftWindows 2000
All versions
MicrosoftWindows 2003 Server
All versions
MicrosoftWindows Server 2003
All versions

Weakness classification

CWE-16

References