Cache Corruption on Microsoft DNS Servers
- Microsoft Windows NT 4.0 and Windows 2000 systems running Microsoft DNS Server
The CERT/CC has received reports from sites experiencing cache corruption on systems running Microsoft DNS Server. The default configuration of this software allows data from malicious or incorrectly configured servers to be cached in the DNS server. This corruption can result in erronous DNS information later being returned to any clients which use this server.
In the default configuration, Microsoft DNS server will accept bogus glue records from non-delegated servers. These bogus records will be added to the cache when a client attempts to resolve a particular hostname served by a malicious or incorrectly configured DNS server. The client can be coerced to request such a hostname as a result of an otherwise non-malicious piece of HTML email (such as spam) or in banner advertisements on websites, to give some examples.
Based on information contained in reports of this activity, there are sites actively engaged in this deceptive DNS resolution. These reports indicate that malicious DNS servers are providing bogus glue records for the generic top-level domain servers (gtld-servers.net) potentially resulting in erroneous results (e.g., failed resolution or redirection) for any DNS request.
More information about the problem can be found at
VU#109475 - Microsoft Windows NT and 2000 Domain Name Servers allow non-authoritative RRs to be cached by default
Secure server cache against names pollution
How to Prevent DNS Cache Pollution (Q241352)
Clients resolving hostnames against the corrupted cache can be unknowingly redirected to illegitimate sites. Additionally, applications that rely on DNS information for authentication or access control can potentially be manipulated by erroneous information stored in the cache.
Apply the workarounds supplied by Microsoft at
Internet Engineering Task Force (IETF) Request for Comments (RFCs):
- IETF RFC 1034: DOMAIN NAMES - CONCEPTS AND FACILITIES
- IETF RFC 1035: DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION
- IETF RFC 1912: Common DNS Operational and Configuration Errors
- IETF RFC 2181: Clarifications to the DNS Specification
The CERT/CC is interested in receiving reports of this activity. If machines under your administrative control are compromised, please send mail to email@example.com with the following text included in the subject line: "[CERT#29164]".
Author(s): Chad Dougherty, Roman Danyliw
CERT/CC Contact Information
- Email: firstname.lastname@example.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
- CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from
Getting security informationCERT publications and other security information are available from our web site email@example.com. Please include in the body of your message
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.
Conditions for use, disclaimers, and sponsorship information
Copyright 2001 Carnegie Mellon University.
August 31, 2001: Initial Release