CVE-2007-1644

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients in certain deployments or configurations, which allows remote attackers to change DNS records for a web proxy server and conduct man-in-the-middle (MITM) attacks on web traffic, conduct pharming attacks by poisoning DNS records, and cause a denial of service (erroneous name resolution).

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2007
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2007

CVE-2007-164510.0Buffer overflow in FutureSoft TFTP Server 2000 on Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via a long reCVE-2007-16464.3Multiple cross-site scripting (XSS) vulnerabilities in SubHub 2.3.0 allow remote attackers to inject arbitrary web script or HTML via (1) thCVE-2007-16477.8Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, CVE-2007-16487.80irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC server that sends a loCVE-2007-16497.8PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input strinCVE-2007-16507.8pcapsipdump.cpp in pcapsipdump before 0.1.3 allows remote attackers to cause a denial of service (application crash) via a malformed SIP pacCVE-2007-16516.8Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to restore the login session of a user on an OpenID enableCVE-2007-16527.5OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, andCVE-2007-16537.8GlowWorm FW before 1.5.3b4 allows remote attackers to cause a denial of service (kernel panic) via certain DNS responses that trigger infiniCVE-2007-16549.3Buffer overflow in the Ne7sshSftp::addOpenHandle function in ne7ssh_sftp.cpp in NetSieben SSH Library (ne7ssh) before 1.2.1 allows user-assiCVE-2007-165510.0Buffer overflow in the fun_ladd function in funmath.cpp in TinyMUX before 20070126 might allow remote attackers to cause a denial of serviceCVE-2007-16567.5Multiple SQL injection vulnerabilities in index.php in Katalog Plyt Audio 1.0 and earlier allow remote attackers to execute arbitrary SQL co
CVE-2007-1644: Critical severity, CVSS 10.0 | Vulnix