Windows Server 2008 DNS Block Feature

Windows Server 2008 introduces a DNS block feature that may affect the ISA Server automatic discovery when implementing the WPAD mechanism using a Windows Server 2008 DNS Server. The block feature provides a global query block list to reduce vulnerability associated with dynamic DNS updates. Dynamic update makes it possible for DNS client computers to […]

Windows Server 2008 introduces a DNS block feature that may affect the ISA Server automatic discovery when implementing the WPAD mechanism using a Windows Server 2008 DNS Server.

The block feature provides a global query block list to reduce vulnerability associated with dynamic DNS updates. Dynamic update makes it possible for DNS client computers to register and dynamically update their resource records with a DNS server whenever a client changes its network address or host name. This reduces the need for manual administration of zone records, especially for clients that frequently move or change locations and use DHCP to obtain an IP address. This convenience comes at a cost, however, because an authorized client can register any unused host name, even a host name that might have special significance for certain applications. This can allow a malicious user to "hijack" a special name and divert certain types of network traffic to that user's computer. WPAD is a commonly deployed protocol vulnerable to this type of hijacking, and by default WPAD look up is disabled by the blocking mechanism.

Full Article

Microsoft, WS2008, Windows Server 2008, DNS, Features