Vulnerability record · CVE-2006-3441 · published 9 August 2006
CVE-2006-3441: Microsoft Windows DNS Client Service buffer overflow via crafted DNS response
Microsoft · Windows 2000
The DNS Client service in Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 contains a buffer overflow reachable through a crafted DNS record response. Microsoft's MS06-041 treats it as one issue, but the record notes multiple vectors, including a heap overflow in a server response, malformed ATMA records, and a length miscalculation in TXT, HINFO, X25 and ISDN records. Successful exploitation allows remote code execution on the affected host.
Description
Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response. NOTE: while MS06-041 implies that there is a single issue, there are multiple vectors, and likely multiple vulnerabilities, related to (1) a heap-based buffer overflow in a DNS server response to the client, (2) a DNS server response with malformed ATMA records, and (3) a length miscalculation in TXT, HINFO, X25, and ISDN records.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score is 10.0 with network reachability, no authentication and full confidentiality, integrity and availability impact, and EPSS is in the 99th percentile.
What it is
The DNS Client service in Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 contains a buffer overflow reachable through a crafted DNS record response. Microsoft's MS06-041 treats it as one issue, but the record notes multiple vectors, including a heap overflow in a server response, malformed ATMA records, and a length miscalculation in TXT, HINFO, X25 and ISDN records. Successful exploitation allows remote code execution on the affected host.
Impact
A remote attacker can execute arbitrary code in the context of the DNS Client service, which typically runs with high privileges on the host. This can lead to full system compromise without any user action.
Attack surface
The flaw is reached over the network through DNS responses processed by the Windows DNS Client service, with no authentication required. No user interaction is needed beyond the client resolving or receiving a malicious response.
Exploitation
The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at 0.61963 (99.1st percentile), indicating a strong likelihood of exploitation activity. Reference tags include Patch and US Government Resource, with no public exploit tag supplied.
What to do
- Apply Microsoft security bulletin MS06-041 (or the corresponding OS patch) to all affected Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 systems.
- Retire or isolate unsupported Windows 2000 and early XP/2003 builds that cannot be patched.
- Restrict outbound DNS to trusted resolvers and block direct client access to untrusted DNS servers where feasible.
- Monitor for anomalous DNS response traffic and unexpected service crashes on legacy Windows hosts.
Detection
- Hunt for crashes or restarts of the DNS Client service (dnscache) on affected Windows versions.
- Inspect DNS response traffic for malformed ATMA, TXT, HINFO, X25 or ISDN records and abnormal record lengths.
- Correlate host telemetry for unexpected code execution or process creation originating from the DNS Client service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3441 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3441), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
