VULNERABILITY INTELLIGENCE
CVE-2008-0087
CVSS score7.5 HIGH
EPSS probability32.45%
CISA KEVNot currently listed
Published2008-04-08
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses.
Weakness classification
- CWE-330: Use of Insufficiently Random Values
Primary references
- secure@microsoft.com — Mailing List, Third Party Advisory
- secure@microsoft.com — Broken Link, Third Party Advisory
- secure@microsoft.com — Broken Link, Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link, Patch, Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link, Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link
- secure@microsoft.com — Broken Link, Third Party Advisory, US Government Resource
- secure@microsoft.com — Broken Link
- secure@microsoft.com — Patch, Vendor Advisory
- secure@microsoft.com — Broken Link, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory