CVE-2000-1218 in Windows
Summary
by MITRE
The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts that it did not query, which allows remote attackers to poison the DNS cache.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability described in CVE-2000-1218 represents a critical security flaw in the domain name resolution implementation across multiple Microsoft Windows operating systems including Windows 98 NT 4.0 2000 and XP. This issue stems from the default configuration of the Windows DNS resolver component which improperly handles DNS update requests. The core technical flaw manifests through the QueryIpMatching parameter being set to zero by default, creating a significant security weakness in the DNS resolution process. This misconfiguration allows any remote host to submit DNS update records to Windows systems without proper verification of the originating IP address, fundamentally undermining the integrity of the DNS resolution mechanism.
The operational impact of this vulnerability is severe as it enables remote attackers to perform DNS cache poisoning attacks against affected systems. When the QueryIpMatching parameter is set to zero Windows accepts DNS updates from any host regardless of whether that host was previously queried for the specific domain name. This creates an opportunity for attackers to inject malicious DNS records into the cache, redirecting traffic to malicious servers or intercepting communications. The vulnerability essentially allows attackers to manipulate the DNS resolution process without requiring authentication or direct access to the target system, making it particularly dangerous in network environments where DNS resolution is critical for system operations.
From a cybersecurity perspective this vulnerability aligns with several ATT&CK framework techniques including T1071.004 Application Layer Protocol DNS and T1566 Credential Access. The flaw represents a classic example of insufficient input validation and improper access control in network services. According to CWE classification this vulnerability maps to CWE-284 Improper Access Control which specifically addresses inadequate access restrictions in system components. The vulnerability demonstrates how default configurations can create security risks that persist across multiple versions of an operating system, highlighting the importance of proper security hardening practices during system deployment.
The mitigation strategy for CVE-2000-1218 involves manually configuring the QueryIpMatching parameter to a value of 1 or higher, which enforces proper IP address matching for DNS updates. System administrators should also implement additional network security measures including DNS update restrictions, proper firewall configurations, and monitoring for suspicious DNS activity. Regular security audits and vulnerability assessments should be conducted to ensure that default configurations have been properly hardened. Microsoft released patches and updates to address this vulnerability, and organizations should ensure they have applied the appropriate security updates to their Windows systems. The vulnerability underscores the critical importance of reviewing default security settings in network infrastructure components and implementing defense-in-depth strategies to protect against DNS-based attacks.