Vulnerability CVE-2008-4126
Published: 2008-09-18   Modified: 2012-02-12

Description:
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.

Type:

CWE-16

 (Configuration)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Debian -> Python-dns 

 References:
http://www.openwall.com/lists/oss-security/2008/09/16/4
http://www.openwall.com/lists/oss-security/2008/09/11/1
http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217
Copyright 2024, cxsecurity.com

 

Back to Top