Vulnerability record · CVE-2007-3898 · published 14 November 2007
CVE-2007-3898: Microsoft Windows DNS Server Predictable Transaction ID Cache Poisoning
Microsoft · Windows 2000
The DNS server in Windows 2000 Server SP4 and Server 2003 SP1/SP2 uses predictable transaction IDs when querying upstream DNS servers. Because these IDs can be guessed, a remote attacker can forge DNS replies and poison the resolver's cache. This undermines name resolution integrity for any client relying on the affected server.
Description
The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.
AV:N/AC:L/Au:N/C:N/I:P/A:P
Automated analysis
high priorityThe flaw is remotely exploitable without authentication, public exploit material is referenced, and EPSS is very high, though the affected platforms are legacy and no KEV listing exists.
What it is
The DNS server in Windows 2000 Server SP4 and Server 2003 SP1/SP2 uses predictable transaction IDs when querying upstream DNS servers. Because these IDs can be guessed, a remote attacker can forge DNS replies and poison the resolver's cache. This undermines name resolution integrity for any client relying on the affected server.
Impact
An attacker can inject forged DNS records into the server's cache, redirecting users to attacker-controlled hosts and enabling follow-on attacks such as credential theft or malware delivery. The CVSS vector shows partial integrity and availability impact with no confidentiality impact.
Attack surface
Reachable over the network with no authentication and no user interaction, per the AV:N/AC:L/Au:N vector. The attacker only needs to send spoofed DNS responses to the vulnerable server while it is resolving queries.
Exploitation
Not listed in CISA KEV, but EPSS is high at 0.523 (99th percentile), and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.
What to do
- Apply Microsoft security bulletin MS07-062 to affected Windows 2000 Server SP4 and Server 2003 SP1/SP2 systems.
- Upgrade or migrate off Windows 2000 and Windows Server 2003, which are long past end of support.
- Restrict recursive DNS resolution to trusted clients and disable recursion on servers that do not need it.
- Use source port randomization and DNSSEC where supported to harden resolution against spoofing.
- Monitor and filter outbound DNS traffic to limit an attacker's ability to reach the resolver.
Detection
- Monitor DNS server logs for unexpected cache entries or resolution anomalies pointing to unfamiliar IP addresses.
- Alert on spikes in DNS response traffic or repeated responses to queries the server did not send.
- Compare resolver cache contents against authoritative sources for critical internal and external domains.
- Watch for client connections to newly resolved hosts that deviate from normal DNS behavior baselines.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-3898 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-3898), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
