CVE-2008-1637

Published Apr 2, 2008

Last updated 6 years ago

Overview

Description: PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-189

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BFBA9267-A53C-4D1E-95BE-B69BA5C03DF3",
            "versionEndIncluding": "3.1.4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References