Microsoft Windows 98/XP/NT 4.0/2000 Domain Name Resolver QueryIpMatching authentication spoofing

Summaryinfo

A vulnerability classified as critical has been found in Microsoft Windows 98/XP/NT 4.0/2000. Affected by this vulnerability is an unknown functionality of the component Domain Name Resolver. The manipulation of the argument QueryIpMatching with the input 0 leads to authentication spoofing. This vulnerability is referenced as CVE-2000-1218. No exploit is available. Due to its background and reception, this vulnerability has an historic impact. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Microsoft Windows 98/XP/NT 4.0/2000 (Operating System). This issue affects some unknown processing of the component Domain Name Resolver. The manipulation of the argument QueryIpMatching with the input value 0 leads to a authentication spoofing vulnerability. Using CWE to declare the problem leads to CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts that it did not query, which allows remote attackers to poison the DNS cache.

The issue has been introduced in 08/24/1996. The weakness was published 04/14/2000 as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. The identification of this vulnerability is CVE-2000-1218 since 04/21/2005. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/12/2024). Due to its background and reception, this vulnerability has a historic impact.

The vulnerability was handled as a non-public zero-day exploit for at least 1329 days. During that time the estimated underground price was around $25k-$100k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (4280) and Vulnerability Center (SBV-2608†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 98
• 2000
• NT 4.0
• XP

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion