CVE-2024-37968
Published: 13 August 2024
Summary
CVE-2024-37968 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows DNS contains a spoofing vulnerability, CVE-2024-37968, that permits an attacker to forge DNS responses. The flaw is present in the Windows DNS client and resolver components and carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, and no required privileges or user interaction. It is associated with CWE-345, indicating insufficient verification of message authenticity.
An unauthenticated remote attacker positioned on the network can send crafted DNS replies that the Windows resolver accepts as legitimate. Successful exploitation results in disclosure of information that would otherwise require direct access to the queried resources, while integrity and availability remain unaffected.
Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37968 addresses the issue and supplies patch information for supported Windows releases. The associated EPSS values have remained low and essentially flat since disclosure, providing no indication of rising exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36920
Vulnerability details
Windows DNS Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly requires independent verification of matching output before adverse decisions, mitigating insufficient authenticity checks on data from external sources.
Use of approved PKI certificates provides verifiable data authenticity and origin for communications and artifacts.
Mandates provision of authenticity and integrity artifacts that enable verification of name/address resolution data.
Requires explicit verification of data authenticity from authoritative sources, preventing acceptance of unauthenticated resolution responses.
Control requires verification of data authenticity/integrity (e.g., checksums) after aggregation/packing, directly reducing exploitation of insufficient verification before transmission.
Time synchronization supports reliable freshness verification when checking data authenticity across systems or components.
Mandates verification of data authenticity for software, firmware, and information.
Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.