CVE-2007-3152

2007-06-1122:30:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

c-ares

dns

vulnerability

cve-2007-3152

6.7 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.016 Low

EPSS

Percentile

87.1%

JSON

c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value.

CPENameOperatorVersion
daniel_stenberg:c-aresdaniel stenberg c-areseq1.3
daniel_stenberg:c-aresdaniel stenberg c-areseq1.0
daniel_stenberg:c-aresdaniel stenberg c-areseq1.3.2
daniel_stenberg:c-aresdaniel stenberg c-areseq1.2.1
daniel_stenberg:c-aresdaniel stenberg c-areseq1.2
daniel_stenberg:c-aresdaniel stenberg c-areseq1.3.1
daniel_stenberg:c-aresdaniel stenberg c-areseq1.1

CPE	Name	Operator	Version
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.3
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.0
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.3.2
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.2.1
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.2
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.3.1
daniel_stenberg:c-ares	daniel stenberg c-ares	eq	1.1