Multiple vulnerabilities have been identified in Microsoft Windows, which could be exploited to conduct DNS spoofing and cache poisoning attacks.
The first issue is caused due to the DNS server not reusing cached responses when receiving specially crafted queries thereby allowing greater predictability of subsequent transaction IDs used by the DNS server, which could be exploited to insert arbitrary addresses into the DNS cache.
The second vulnerability is caused due to the DNS server not correctly caching specifically crafted DNS responses, which could result in the DNS server making unnecessary lookups and leads to greater predictability of subsequent transaction IDs used by the DNS server.
The third issue is caused due to the DNS server not correctly validating who can register WPAD entries on the DNS server, which could allow any user to create a registration in the DNS database for Web Proxy Auto-Discovery (WPAD) if the name registration does not already exist.
The fourth vulnerability is caused due to the WINS server not correctly validating who can register WPAD or ISATAP entries on the WINS server, which could allow any user to create a registration in the WINS database for WPAD or ISATAP if the name registration does not already exist.
