CVE-2000-1218 The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts tha...
CriticalCVSS 9.8
EPSS 6.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts that it did not query, which allows remote attackers to poison the DNS cache.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 98 | All versions | No fix listed |
| Microsoft windows 98se | All versions | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- VU#458659 third-party-advisory us-government-resource
- win2k-dns-resolver(4280) third-party-advisory vdb-entry