CVE-2008-4100

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2008-4100
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698
http://www.openwall.com/lists/oss-security/2008/09/11/1
http://www.openwall.com/lists/oss-security/2008/09/16/4
https://www.exploit-db.com/exploits/6197
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnu:adns:*:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.3:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.4:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.5:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.6:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.7:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.8:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:0.9:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:adns:1.3:*:*:*:*:*:*:*
History

07 Nov 2023, 02:02

Type Values Removed Values Added
Summary GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment. GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.

13 Feb 2023, 02:19

Type Values Removed Values Added
Summary GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment. GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
Information

Published : 2008-09-18 17:59

Updated : 2023-12-10 10:51

NVD link : CVE-2008-4100

Mitre link : CVE-2008-4100

CVE.ORG link : CVE-2008-4100

JSON object : View

Products Affected

gnu

  • adns
CWE
CWE-16

Configuration