FreeBSD : c-ares -- DNS Cache Poisoning Vulnerability (70ae62b0-16b0-11dc-b803-0016179b2dd5)

Secunia reports : The vulnerability is caused due to predictable DNS 'Transaction ID' field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

CVE-2007-3153

The CVE-2007-3153 entry describes a vulnerability in the c-ares library: on non-Windows platforms, ares_init:randomize_key uses a weak random-number source (Unix rand), enabling attackers to spoof DNS responses by guessing values. The issue is linked to multiple advisories and updates (e.g., Fedo...

CVE-2007-3153

The aresinit:randomizekey function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence Unix rand, which makes it easier for remote attackers to spoof DNS responses by guessing certain values...