CVE-2012-1194

Exploitation likely. EPSS gives it a 9.7% chance of exploitation in the next 30 days. No fix published yet.

CVSS 2.06.4Medium EPSS percentile95th9.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2012-02-17Updated 2026-04-29Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your organization still runs Windows Server 2008 (before R2) as a DNS server.
If so, identify who manages that server — internal IT or a hosting/managed-services vendor.
Ask them to confirm whether this issue has been addressed, since no official fix has been published for this specific flaw.
Prioritize migrating off Windows Server 2008 entirely, as it is long out of support and carries many unrelated risks.
In the meantime, restrict which networks can send DNS queries to this server to reduce exposure.

May need vendor or contractor work

What it is

From the CVE record

The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

In plain language

Written by AI from the record

This is a flaw in old Windows Server 2008 DNS servers that lets attackers keep expired or revoked domain names resolvable longer than they should; it's not known to be under active attack, so most small businesses don't need to panic, but it's worth checking if you still run this old server.

Unauthenticated remote attackers can poison NS record caching in Windows Server 2008's DNS resolver by sending crafted A-record query responses, enabling a 'ghost domain names' attack that keeps revoked domains resolvable past their intended expiration.

If you're affected

Prolonged access to malicious revoked domains
DNS cache integrity compromised
Phishing/malware domains stay resolvable
Operational disruption on legacy DNS infrastructure

What is it

Think of your DNS server as an address book that tells computers where websites live. This bug lets someone trick the address book into keeping an old, revoked address entry active even after it should have expired — so a domain that was supposed to be shut down (maybe because it was malicious) can keep working longer than it should. It only affects an old, outdated version of Windows Server used to run DNS services.

Who is affected

This matters to you only if you operate your own DNS server using Windows Server 2008 (the version before R2) — most small businesses use their domain registrar's or hosting provider's DNS and are not affected. It also only applies if that DNS server is reachable from the internet, which is the normal, default setup for public DNS servers.

How urgent is it

There is no evidence this is being exploited in the wild, and it isn't listed as a known active threat. Given the lack of real-world attack activity and the very old, increasingly rare target software, this is a low-urgency item — review it during normal maintenance rather than treating it as an emergency.

What to do — in detail

Confirm exposure: identify any DNS servers in your environment running Windows Server 2008 (pre-R2) and check if they are internet-facing (default DNS deployments typically are). 2. Check for vendor guidance: no official patch/fix information is currently on record for this specific CVE, so verify directly with Microsoft support or your support contract whether a hotfix or cumulative update addresses NS record cache validation. 3. Mitigation if unpatched: restrict recursive/authoritative query acceptance to trusted networks, enable DNSSEC validation where possible, and monitor for anomalous repeated A-record queries targeting the same domain from varied sources (a signature of ghost domain attacks). 4. Long-term: plan migration off Windows Server 2008, which is end-of-life and carries unrelated unpatched risks beyond this CVE. 5. Monitor: watch DNS cache entries for NS records that persist beyond expected TTL for domains known to have been revoked or delegated elsewhere.

Technical context

CVSS 6.4 (Medium, AV:N/AC:L/Au:N/C:N/I:P/A:P) reflects network-exploitable, low-complexity, no-authentication integrity/availability impact with no confidentiality loss. This is a CWE-Other weakness in resolver cache-update logic: processing an A-record query response causes incorrect overwriting of cached NS record server names and TTL values, enabling the published 'ghost domain names' attack technique to sustain resolvability of revoked domains. Not listed in CISA KEV; no public exploit code is on record. EPSS places likelihood of near-term exploitation in the moderate percentile range (used for internal prioritization only, not for public urgency framing per current guidance). No patch/fix information is available in current findings — verify directly with vendor. Exploit maturity: theoretical/conceptual (named attack technique exists in research literature) with no confirmed in-the-wild activity.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.