GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product’s intended role in a trusted environment.

Affected configurations

NVD

Node

gnuadnsRange≤1.4

gnuadnsMatch0.1

gnuadnsMatch0.2

gnuadnsMatch0.3

gnuadnsMatch0.4

gnuadnsMatch0.5

gnuadnsMatch0.6

gnuadnsMatch0.7

gnuadnsMatch0.8

gnuadnsMatch0.9

gnuadnsMatch1.0

gnuadnsMatch1.1

gnuadnsMatch1.2

gnuadnsMatch1.3

References

bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698

www.openwall.com/lists/oss-security/2008/09/11/1

www.openwall.com/lists/oss-security/2008/09/16/4

www.exploit-db.com/exploits/6197

debiancve 3

cve 6

cvelist 7

ubuntucve 4

prion 7

checkpoint_advisories 3

freebsd 2

oraclelinux 2

nessus 36

openvas 67

fedora 3

debian 10

redhat 2

exploitpack 3

securityvulns 8

suse 1

gentoo 3

packetstorm 3

altlinux 5

osv 2

seebug 5

f5 2

slackware 3

freebsd_advisory 1

ubuntu 2

checkpoint_security 1

nvd 4

centos 2

rubygems 1

mskb 1

debiancve

CVE-2008-4100

2008-09-18 17:59:32

CVE-2008-1447

2008-07-08 23:41:00

CVE-2008-4099

2008-09-18 17:59:32

cve

CVE-2008-4100

2008-09-18 17:59:32

CVE-2008-1447

2008-07-08 23:41:00

CVE-2008-1454

2008-07-08 23:41:00

cvelist

CVE-2008-4100

2008-09-18 17:47:00

CVE-2008-1447

2008-07-08 23:00:00

CVE-2008-4099

2008-09-18 17:47:00

ubuntucve

CVE-2008-4100

2008-09-18 00:00:00

CVE-2008-1447

2008-07-08 00:00:00

CVE-2008-3905

2008-09-04 00:00:00

prion

Design/Logic Flaw

2008-09-18 17:59:00

Spoofing

2008-07-08 23:41:00

Design/Logic Flaw

2008-07-08 23:41:00

checkpoint_advisories

Preemptive Protection against Multiple Vendor DNS Insufficient Socket Entropy Vulnerability

2008-07-08 00:00:00

Microsoft Windows DNS Insufficient Socket Entropy (MS08-037; CVE-2008-1447)

2011-11-01 00:00:00

Microsoft Windows DNS Insufficient Socket Entropy (MS08-037) - High Confidence (CVE-2008-1447)

2013-05-09 00:00:00

freebsd

FreeBSD -- DNS cache poisoning

2008-07-08 00:00:00

ruby -- DNS spoofing vulnerability

2008-08-08 00:00:00

oraclelinux

dnsmasq security update

2008-08-11 00:00:00

bind security update

2008-07-08 00:00:00

nessus

openSUSE 10 Security Update : bind (bind-5410)

2008-07-15 00:00:00

openSUSE 10 Security Update : dnsmasq (dnsmasq-5512)

2008-08-15 00:00:00

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / current : dnsmasq (SSA:2008-205-01)

2008-07-24 00:00:00

openvas

Debian Security Advisory DSA 1617-1 (refpolicy)

2008-08-15 00:00:00

Gentoo Security Advisory GLSA 200807-08 (bind)

2008-09-24 00:00:00

Nmap NSE net: dns-random-txid

2011-06-01 00:00:00

fedora

[SECURITY] Fedora 9 Update: bind-9.5.0-33.P1.fc9

2008-07-09 21:45:32

[SECURITY] Fedora 9 Update: dnsmasq-2.45-1.fc9

2009-02-14 22:11:22

[SECURITY] Fedora 9 Update: bind-9.5.1-1.P1.fc9

2009-01-15 02:51:25

debian

[SECURITY] [DSA 1617-1] New refpolicy packages fix incompatible policy

2008-07-25 06:29:36

[SECURITY] [DSA 1617-1] New refpolicy packages fix incompatible policy

2008-07-25 06:29:36

[SECURITY] [DSA 1619-1] New python-dns packages fix DNS response spoofing

2008-07-27 09:36:54

redhat

(RHSA-2008:0533) Important: bind security update

2008-07-08 00:00:00

(RHSA-2008:0789) Moderate: dnsmasq security update

2008-08-11 00:00:00

exploitpack

BIND 9.x - Remote DNS Cache Poisoning

2008-07-25 00:00:00

BIND 9.4.1 9.4.2 - Remote DNS Cache Poisoning (Metasploit)

2008-07-23 00:00:00

BIND 9.x - Remote DNS Cache Poisoning (Python)

2008-07-24 00:00:00

securityvulns

Cisco Security Advisory: Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks

2008-07-12 00:00:00

[SECURITY] [DSA 1619-1] New python-dns packages fix DNS response spoofing

2008-07-29 00:00:00

CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning Flaw Exploit

2008-07-25 00:00:00

suse

DNS cache poisoning in bind

2008-07-11 09:57:52

gentoo

BIND: Cache poisoning

2008-07-11 00:00:00

dnsmasq: Denial of Service and DNS spoofing

2008-09-04 00:00:00

pdnsd: Denial of Service and cache poisoning

2009-01-11 00:00:00

packetstorm

bailiwicked_domain.rb.txt

2008-07-24 00:00:00

bind9x-poison.txt

2008-07-25 00:00:00

bailiwicked_host.rb.txt

2008-07-24 00:00:00

altlinux

Security fix for the ALT Linux 6 package bind version 9.3.5-alt2

2008-06-06 00:00:00

Security fix for the ALT Linux 5 package bind version 9.3.5-alt2

2008-06-06 00:00:00

Security fix for the ALT Linux 5 package ruby version 1.8.7-alt6

2008-08-12 00:00:00

osv

bind9 - cache poisoning

2008-07-08 00:00:00

refpolicy - incompatible policy

2008-07-25 00:00:00

seebug

BIND 9.4.1-9.4.2 Remote DNS Cache Poisoning Flaw Exploit (py)

2008-07-24 00:00:00

BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (py)

2008-07-24 00:00:00

BIND 9.4.1-9.4.2 Remote DNS Cache Poisoning Flaw Exploit (meta)

2008-07-24 00:00:00

K8938 : BIND DNS cache poisoning vulnerability - CVE-2008-1447 - VU#800113

2013-03-19 00:00:00

SOL8938 - BIND DNS cache poisoning vulnerability - CVE-2008-1447 - VU#800113

2008-07-10 00:00:00

slackware

[slackware-security] bind

2008-07-10 04:29:01

[slackware-security] ruby

2008-11-29 21:37:03

[slackware-security] dnsmasq

2008-07-24 00:02:47

freebsd_advisory

FreeBSD-SA-08:06.bind

2008-07-13 00:00:00

ubuntu

Bind vulnerability

2008-07-08 00:00:00

Dnsmasq vulnerability

2008-07-22 00:00:00

checkpoint_security

Check Point response to DNS poisoning vulnerability CVE-2008-1447

2008-07-05 21:00:00

nvd

CVE-2008-1447

2008-07-08 23:41:00

CVE-2008-5133

2008-11-18 16:00:00

CVE-2008-3905

2008-09-04 17:41:00

centos

bind security update

2008-07-09 01:20:56

bind, caching, selinux security update

2008-07-08 22:25:27

rubygems

ruby -- DNS spoofing vulnerability in resolv.rb

2008-05-04 20:00:00

mskb

MS08-037: Vulnerabilities in DNS could allow spoofing

2018-04-17 19:03:20

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

6.4 Medium

AI Score

Confidence

High

0.133 Low

EPSS

Percentile

95.6%

JSON

Related for NVD:CVE-2008-4100

debiancve3 cve6 cvelist7 ubuntucve4 prion7 checkpoint_advisories3 freebsd2 oraclelinux2 nessus36 openvas67 fedora3 debian10 redhat2 exploitpack3 securityvulns8 suse1 gentoo3 packetstorm3 altlinux5 osv2 seebug5 f52 slackware3 freebsd_advisory1 ubuntu2 checkpoint_security1 nvd4 centos2 rubygems1 mskb1