CVE-2008-4100

GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnu:adns:*:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.3:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.4:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.5:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.6:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.7:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.8:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.9:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.3:*:*:*:*:*:*:*

History

21 Nov 2024, 00:50

Type Values Removed Values Added
References () http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698 - () http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698 -
References () http://www.openwall.com/lists/oss-security/2008/09/11/1 - () http://www.openwall.com/lists/oss-security/2008/09/11/1 -
References () http://www.openwall.com/lists/oss-security/2008/09/16/4 - () http://www.openwall.com/lists/oss-security/2008/09/16/4 -
References () https://www.exploit-db.com/exploits/6197 - () https://www.exploit-db.com/exploits/6197 -

07 Nov 2023, 02:02

Type Values Removed Values Added
Summary GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment. GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.

Information

Published : 2008-09-18 17:59

Updated : 2024-11-21 00:50


NVD link : CVE-2008-4100

Mitre link : CVE-2008-4100

CVE.ORG link : CVE-2008-4100


JSON object : View

Products Affected

gnu

  • adns
CWE
CWE-16

Configuration