<--

Microsoft Windows Unprivileged DNS Cache Flushing

Aleph Research Advisory

Identifier

Severity

Moderate

Product

Microsoft Windows

Technical Details

A non-administrative user can flush the DNS cache, effectively neutralizing the TTL’s impact on incoming responses. Although the ‘ipconfig’ command (when run together with the ‘/flushdns’ switch) does verify that the user has administrative rights (the verification is done by calling advpapi32.dll!CheckTokenMembership with BUILTIN\Administrators), this restriction can be bypassed either by calling DnsApi.dll!DnsFlushResolverCache or by directly issuing the appropriate RPC to the stub resolver service.

Timeline

Credit

External References