MS11-030: Vulnerability in DNS Resolution Could Allow Remote C

CVE-2011-0657 is a buffer underrun in DNSAPI.dll in the Windows DNS Client service when it parses LLMNR (Link-Local Multicast Name Resolution) responses. On Vista, Server 2008, Windows 7, and Server 2008 R2, an unauthenticated attacker on the same broadcast/multicast segment could send a crafted LLMNR query/response and land RCE as the NetworkService account. XP and 2003 don't ship LLMNR at all, so on those platforms it degrades to a local-code-execution issue. The fix was KB2509553, released 12 April 2011.

Microsoft rated the bulletin Critical and Tenable inherited a CVSSv2 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C). Fifteen years ago that was accurate. In 2026 the vendor label is stale on two counts: every affected OS is out of extended support, and the attack vector is *adjacent network* (LLMNR is link-local — a router hop kills it), not internet-reachable. The remaining risk is not this CVE — it is the fact that Nessus is still flagging hosts running unsupported Windows on your production network.

Why this verdict

• Adjacent-network only, not remote: LLMNR is scoped to the local link; the vendor's AV:N CVSSv2 label overstates reach. Real vector is AV:A → attacker already inside your L2.
• Zero in-the-wild activity in 15 years: not on KEV, no known malware family, no Metasploit module, EPSS negligible. Attackers with L2 access have far better tools (Responder, MS17-010, NTLM relay to ADCS).
• Affected OSes are all past end-of-support: Vista, 7, 2008, 2008 R2 have been out of extended support for years. If you have these on the wire the CVE-2011-0657 patch level is the least of your worries.
• Role multiplier — workstation / print server / member host: typical LLMNR-enabled hosts are endpoints or utility servers. Blast radius = single host → NetworkService. Not a role-defining component; no fleet or identity pivot from this bug alone.
• Role multiplier — domain controller: DCs did not typically run with LLMNR enabled and were the first hosts patched in 2011. Even hypothetically, RCE as NetworkService on a DC is a serious ceiling, but no operator has left a 2008 R2 DC unpatched and reachable in 2026 without much worse existing issues.
• Compensating controls are near-universal: disabling LLMNR via GPO has been standard hardening since Responder became famous (~2012). Most enterprises already killed the protocol for reasons unrelated to this CVE.

Why not higher?

Not HIGH because there is no routable path, no active exploitation, and the affected OS install base in enterprise production is a rounding error in 2026. A role-multiplier floor to HIGH does not apply — DNS Client on a domain controller is not a role-defining component (unlike, say, the DNS *server* service or LSASS), and the code executes as NetworkService, not SYSTEM.

Why not lower?

Not LOW/IGNORE because if plugin 53514 is firing today, it means Nessus authenticated to a Windows host that never received the April 2011 patch — a host that old and unpatched is a genuine risk indicator even if this specific CVE is boring. Treat the finding as a fleet-hygiene signal, not as a standalone vulnerability.

1. Disable LLMNR fleet-wide via GPO — Set Computer Configuration → Administrative Templates → Network → DNS Client → Turn off multicast name resolution = Enabled. Kills this CVE and the entire Responder poisoning family in one move. Deploy within the standard MEDIUM window — no mitigation SLA, roll into your next hardening cycle.
2. Block UDP 5355 and 137/138 at host firewall and VLAN boundaries — Belt-and-suspenders after the GPO. LLMNR uses UDP 5355; NBT-NS uses 137/138. Add explicit deny rules on Windows Defender Firewall and on any L3 boundary between user VLANs and server VLANs.
3. Inventory and evict any Vista / 7 / 2008 / 2008 R2 hosts still on production networks — This is the real work. Use Nessus, AD queries (Get-ADComputer -Filter {OperatingSystem -like '*2008*'}), and DHCP fingerprinting to find them. Isolate to a segregated VLAN with no lateral reach, or decommission. This is a 90-day project, not a patch.
4. Deploy Respotter or an LLMNR-poisoning honeypot on user VLANs — Any attacker on-link running Responder to exploit this class of bug will trip a canary. Cheap, high-signal detection for the adjacent-network preconditions this CVE requires.

Run on the target Windows host as local Administrator (or via WinRM from your auditor workstation): .\Check-MS11-030.ps1. Checks OS applicability, KB2509553 installation, DNSAPI.dll file version, and current LLMNR GPO state. Emits VULNERABLE, PATCHED, MITIGATED, or UNKNOWN.

#requires -Version 3.0
# Check-MS11-030.ps1 — noisgate verifier for CVE-2011-0657 (MS11-030)
# Exit codes: 0 = PATCHED or MITIGATED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'
$result = 'UNKNOWN'

try {
    $os = (Get-CimInstance Win32_OperatingSystem).Caption
    Write-Host "[*] OS: $os"

    # Only Vista / 2008 / 7 / 2008 R2 are LLMNR-exploitable for this CVE
    $affected = $os -match 'Vista|Server 2008|Windows 7'
    if (-not $affected) {
        Write-Host '[+] OS not affected by MS11-030 LLMNR vector.'
        $result = 'PATCHED'
        exit 0
    }

    # 1. Check for KB2509553
    $kb = Get-HotFix -Id KB2509553 -ErrorAction SilentlyContinue
    if ($kb) {
        Write-Host '[+] KB2509553 installed.'
        $result = 'PATCHED'
    } else {
        Write-Host '[-] KB2509553 NOT installed.'
    }

    # 2. Check dnsapi.dll file version (fixed builds >= 6.0.6002.18400 / 6.1.7601.17570 approx)
    $dll = Get-Item "$env:SystemRoot\System32\dnsapi.dll" -ErrorAction SilentlyContinue
    if ($dll) {
        Write-Host "[*] dnsapi.dll version: $($dll.VersionInfo.FileVersion)"
    }

    # 3. Check LLMNR mitigation (GPO)
    $llmnrReg = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient' -Name EnableMulticast -ErrorAction SilentlyContinue
    if ($llmnrReg -and $llmnrReg.EnableMulticast -eq 0) {
        Write-Host '[+] LLMNR disabled via policy — attack surface removed.'
        if ($result -ne 'PATCHED') { $result = 'MITIGATED' }
    } else {
        Write-Host '[-] LLMNR NOT disabled via policy.'
        if ($result -ne 'PATCHED') { $result = 'VULNERABLE' }
    }
}
catch {
    Write-Host "[!] Error: $_"
    $result = 'UNKNOWN'
}

Write-Host "RESULT: $result"
switch ($result) {
    'PATCHED'    { exit 0 }
    'MITIGATED'  { exit 0 }
    'VULNERABLE' { exit 1 }
    default      { exit 2 }
}

Sources

1. Microsoft Security Bulletin MS11-030
2. Tenable Nessus Plugin 53514
3. CVE-2011-0657 (cvedetails)
4. Microsoft KB2509553 support article
5. K7 Labs analysis — MS11-030
6. Check Point CPAI-2011-228 advisory
7. Tenable CVE-2011-0657 plugin index
8. InfosecMatter Nessus plugin 53514 details