CVE-2009-0094 : The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does n

The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap" NetBIOS names, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) features, and conduct man-in-the-middle attacks by spoofing a proxy server or ISATAP route, by registering one of these names in the WINS database, aka "WPAD WINS Server Registration Vulnerability," a related issue to CVE-2007-1692.

Published 2009-03-11 14:19:15

Updated 2019-02-26 14:04:01

Source Microsoft Corporation

View at NVD, CVE.org

Products affected by CVE-2009-0094

Microsoft » Windows 2000 » Update SP4
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2003
cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2003 » Update SP2
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2003 » Update SP1 Itanium Edition
cpe:2.3:o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2003 » Update SP1
cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008
cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » X64 Edition
cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-0094

EPSS FAQ

96.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-0094

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:P	8.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

References for CVE-2009-0094

Jump to

Vulnerability Details : CVE-2009-0094

Products affected by CVE-2009-0094

Exploit prediction scoring system (EPSS) score for CVE-2009-0094

CVSS scores for CVE-2009-0094

References for CVE-2009-0094