Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Windows DNS Server Can Be Crashed by Malicious Data

CVE-2021-34499 · published 5 years ago
Summary

A security issue in Windows DNS Server could allow an attacker to send malicious data that crashes the service, making it unavailable to users. This could impact network connectivity and disrupt business operations. To protect against this issue, ensure your Windows systems are up to date with the latest security patches.

What to do
  • Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.25661 or later.
  • Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.25661 or later.
  • Update microsoft windows server 2008 service pack 2 to version 6.0.6003.21167 or later.
  • Update microsoft windows server 2008 service pack 2 (server core installation) to version 6.0.6003.21167 or later.
  • Update microsoft windows server 2012 to version 6.2.9200.23409 or later.
  • Update microsoft windows server 2012 (server core installation) to version 6.2.9200.23409 or later.
  • Update microsoft windows server 2012 r2 to version 6.3.9600.20069 or later.
  • Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.20069 or later.
  • Update microsoft windows server 2016 to version 10.0.14393.4530 or later.
  • Update microsoft windows server 2016 (server core installation) to version 10.0.14393.4530 or later.
  • Update microsoft windows server 2019 to version 10.0.17763.2061 or later.
  • Update microsoft windows server 2019 (server core installation) to version 10.0.17763.2061 or later.
  • Update microsoft windows server version 2004 to version 10.0.19041.1110 or later.
  • Update microsoft windows server version 20h2 to version 10.0.19042.1110 or later.
Affected software
VendorProductAffected versions
microsoft windows server 2008 r2 service pack 1 < 6.1.7601.25661
microsoft windows server 2008 r2 service pack 1 (server core installation) < 6.1.7601.25661
microsoft windows server 2008 service pack 2 < 6.0.6003.21167
microsoft windows server 2008 service pack 2 (server core installation) < 6.0.6003.21167
microsoft windows server 2012 < 6.2.9200.23409
microsoft windows server 2012 (server core installation) < 6.2.9200.23409
microsoft windows server 2012 r2 < 6.3.9600.20069
microsoft windows server 2012 r2 (server core installation) < 6.3.9600.20069
microsoft windows server 2016 < 10.0.14393.4530
microsoft windows server 2016 (server core installation) < 10.0.14393.4530
microsoft windows server 2019 < 10.0.17763.2061
microsoft windows server 2019 (server core installation) < 10.0.17763.2061
microsoft windows server version 2004 < 10.0.19041.1110
microsoft windows server version 20h2 < 10.0.19042.1110
microsoft windows_server_2008 r2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
microsoft windows_server_2012 r2
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft windows_server_2016 20h2
2004
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
microsoft windows_server_2019 All versions
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Original advisory text
Windows DNS Server Denial of Service Vulnerability
Windows DNS Server Denial of Service Vulnerability
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
3% chance of attack within 30 days
Timeline
Published14 Jul 2021
Updated31 Oct 2026
First seen10 Aug 2026
Sources
CVE-2021-34499 · NVD
CVE-2021-34499 · MITRE
Track software like this
Free during beta