Vulnerability record · CVE-2006-0988 · published 3 March 2006
CVE-2006-0988: Windows DNS Server default recursion enables amplification DoS
Microsoft · Windows 2000
The default DNS Server configuration on Windows 2000, Windows Server 2003 and Windows NT 4.0 permits recursive queries and returns extra delegation information to arbitrary source addresses. Because responses are larger than requests, spoofed-source queries let remote attackers use these servers as traffic amplifiers in denial-of-service floods. The record is old and thin, with no vendor patch identifier or affected-version detail beyond the product names.
Description
The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityUnauthenticated remote network exposure with complete availability impact and very high EPSS, though limited to legacy Windows DNS configurations and with no KEV listing.
What it is
The default DNS Server configuration on Windows 2000, Windows Server 2003 and Windows NT 4.0 permits recursive queries and returns extra delegation information to arbitrary source addresses. Because responses are larger than requests, spoofed-source queries let remote attackers use these servers as traffic amplifiers in denial-of-service floods. The record is old and thin, with no vendor patch identifier or affected-version detail beyond the product names.
Impact
An attacker gains a reflection/amplification vector: spoofed queries generate large DNS responses aimed at a victim, consuming the victim's bandwidth and degrading or halting service. The attacker does not gain code execution or data access.
Attack surface
Reachable over the network via standard DNS queries to UDP/TCP port 53; no authentication and no user interaction are required, as reflected by the AV:N/AC:L/Au:N vector. Any host that can send a DNS packet to the resolver can trigger the behavior.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high (0.595, 99th percentile), indicating substantial predicted exploitation activity. Reference tags are limited to Patch and Vendor Advisory, with no public exploit tag.
What to do
- Apply the vendor guidance in the US-CERT DNS recursion advisory and any available Microsoft updates for the affected Windows versions.
- Disable recursion or restrict it to authorized clients on DNS servers that do not need to serve external resolvers.
- Restrict DNS service exposure with firewall rules so only intended clients can reach port 53.
- Enable response rate limiting (RRL) or equivalent query throttling where supported.
- Retire or isolate unsupported Windows NT 4.0 and Windows 2000 DNS servers.
Detection
- Monitor DNS query logs for high volumes of requests with spoofed or mismatched source addresses.
- Alert on outbound DNS response traffic that is disproportionately larger than inbound query traffic from a single server.
- Track spikes in port 53 traffic toward external destinations that are not normal resolver clients.
- Correlate DNS server query rates with upstream bandwidth anomalies to spot amplification use.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-0988 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-0988), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
