Microsoft DNS server generates predictable DNS transaction IDs. If the server is configured to allow recursive queries it is possible to insert fake records in the DNS cache (DNS cache poisoning) by guessing the next transaction ID that the server will use and sending a spoofed DNS reply to the server. To observe the transaction IDs an attacker needs to control a DNS server that is authoritative for some domain and to be able to send a recursive queries to the caching Microsoft DNS server
http://www.securiteam.com/windowsntf...U00F15KAO.html
