Child pages
  • CERT Incident Note IN-2001-11: Cache Corruption on Microsoft DNS Servers

Pages in the Historical section of this site are provided for historical purposes, they are no longer maintained. Links may not work.

Skip to end of metadata
Go to start of metadata
The CERT Coordination Center publishes incident notes to provide information about incidents to the Internet community.

Cache Corruption on Microsoft DNS Servers

Release Date: August 31, 2001

Systems Affected

  • Microsoft Windows NT 4.0 and Windows 2000 systems running Microsoft DNS Server

I. Overview

The CERT/CC has received reports from sites experiencing cache corruption on systems running Microsoft DNS Server. The default configuration of this software allows data from malicious or incorrectly configured servers to be cached in the DNS server. This corruption can result in erronous DNS information later being returned to any clients which use this server.

II. Description

In the default configuration, Microsoft DNS server will accept bogus glue records from non-delegated servers. These bogus records will be added to the cache when a client attempts to resolve a particular hostname served by a malicious or incorrectly configured DNS server. The client can be coerced to request such a hostname as a result of an otherwise non-malicious piece of HTML email (such as spam) or in banner advertisements on websites, to give some examples.

Based on information contained in reports of this activity, there are sites actively engaged in this deceptive DNS resolution. These reports indicate that malicious DNS servers are providing bogus glue records for the generic top-level domain servers ( potentially resulting in erroneous results (e.g., failed resolution or redirection) for any DNS request.

More information about the problem can be found at

VU#109475 - Microsoft Windows NT and 2000 Domain Name Servers allow non-authoritative RRs to be cached by default

Secure server cache against names pollution

How to Prevent DNS Cache Pollution (Q241352)

III. Impact

Clients resolving hostnames against the corrupted cache can be unknowingly redirected to illegitimate sites. Additionally, applications that rely on DNS information for authentication or access control can potentially be manipulated by erroneous information stored in the cache.

IV. Solutions

Apply the workarounds supplied by Microsoft at

V. References

Internet Engineering Task Force (IETF) Request for Comments (RFCs):

IETF RFC 1912: Common DNS Operational and Configuration Errors
IETF RFC 2181: Clarifications to the DNS Specification

VI. Reporting

The CERT/CC is interested in receiving reports of this activity. If machines under your administrative control are compromised, please send mail to with the following text included in the subject line: "[CERT#29164]".

Author(s): Chad Dougherty, Roman Danyliw

CERT/CC Contact Information

Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
CERT personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

To subscribe to the CERT mailing list for advisories and bulletins, send email to Please include in the body of your message

subscribe cert-advisory

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.
Conditions for use, disclaimers, and sponsorship information

Copyright 2001 Carnegie Mellon University.

Revision History

August 31, 2001: Initial Release

  • No labels