Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Multiple Microsoft DNS Server Cache Spoofing Vulnerabilities (MS09-008)

Subscribe

Check Point Reference: CPAI-2009-036
Date Published:
Severity:
Source: Microsoft Security Bulletin MS09-008
Industry Reference(s): CVE-2009-0233
CVE-2009-0234
Protection Provided by: Security Gateway
  • R70
VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
VSX
  • NGX R65
InterSpect
  • NGX
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Microsoft Windows 2000 Server SP4
Windows Server 2003 SP1
Windows Server 2003 SP2
Windows Server 2003 x64 Edition
Windows Server 2003 x64 Edition SP2
Windows Server 2003 with SP1 (Itanium)
Windows Server 2003 with SP2 (Itanium)
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for x64-based Systems
Vulnerability Description
Multiple spoofing vulnerabilities have been reported in Windows DNS server. These vulnerabilities could allow a remote attacker to spoof responses and insert records into the DNS server's cache. The DNS caching resolver service saves the responses to DNS queries so that the DNS server is not repeatedly queried for the same information. A remote attacker may exploit these issues to create DNS cache poisoning.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS09-008
Vulnerability Details
The vulnerabilities are due to an error in the Windows DNS server that fails to re-use cached responses when receiving specifically crafted duplicate queries, thereby reducing entropy and allowing greater predictability of subsequent transaction IDs used by the DNS server. A remote attacker may exploit this issue by sending specific queries to a vulnerable DNS server and at the same time respond back in a manner that allows the attacker to insert false or misleading DNS data. By poisoning a DNS server, a remote attacker could direct users to malicious sites or prevent them from accessing web sites of their choice.

Protection Overview
By enabling this protection, SmartDefense will detect and block multiple requests with the same domain name sent to the vulnerable server.

In order for the protection to be activated, update your Security Gateway/VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Additional Information
For more information on DNS cache poisoning see SBP-2007-08.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > DNS > Cache Poisoning.
2. In the right pane, double-click the following protection:

Microsoft DNS Server Validation Spoofing Weakness (MS09-008)

3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: DNS Enforcement Violation
Attack Information:
Microsoft DNS server query validation weakness (MS09-008)
Microsoft DNS server cache validation weakness (MS09-008)

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > DNS > Cache Poisoning > Microsoft DNS Server Validation Spoofing Weakness (MS09-008).
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: DNS Enforcement Violation
Attack Information:
Microsoft DNS server query validation weakness (MS09-008)
Microsoft DNS server cache validation weakness (MS09-008)

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > DNS > Cache Poisoning.
2. Select the following protection:

Microsoft DNS Server Validation Spoofing Weakness (MS09-008)

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: DNS Enforcement Violation
Attack Information:
Microsoft DNS server query validation weakness (MS09-008)
Microsoft DNS server cache validation weakness (MS09-008)

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > DNS > Cache Poisoning > Microsoft DNS Server Validation Spoofing Weakness (MS09-008).
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: DNS Enforcement Violation
Attack Information:
Microsoft DNS server query validation weakness (MS09-008)
Microsoft DNS server cache validation weakness (MS09-008)

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > DNS > Cache Poisoning.
3. Select the following protection:

Microsoft DNS Server Validation Spoofing Weakness (MS09-008)

4. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: DNS Enforcement Violation
Attack Information:
Microsoft DNS server query validation weakness (MS09-008)
Microsoft DNS server cache validation weakness (MS09-008)

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Security > DNS, and select the 'DNS Hijack Attack' protection group
3. Click CVE-2009-0233 Mixed-Case Cache Poisoning Attack (MS09-08) (IPS-1 NGX R65 only).
4. Click CVE-2009-0234 IN ANY Cache Poisoning Attack (MS09-08) (IPS-1 NGX R65 only)
5. In the configuration pane, under Settings, check Active.
6. Click on Install Policy.

Note that the collection interval for the protections is configurable via the variable 'CVE-2009-0233 Clean-up Frequency'. The default is 60 seconds.
The maximum threshold for alerting is configurable via the variable 'Maximum number of DNS IN ANY replies within a given time period'. The default is to trigger the alert after 3 failures.

How Do I Know if My Network is Under Attack?
Upon attack, the following entry will be logged:

Alert Name: DNS Hijack Attempt
Description: CVE-2009-0233 Mixed-Case Cache Poisoning Attack (MS09-08)

Alert Name: DNS Hijack Attempt
Description: CVE-2009-0234 IN ANY Cache Poisoning Attack (MS09-08)