CVE-2014-4883

Published Nov 28, 2014

Last updated 3 months ago

Overview

Description: resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.
Source: cret@cert.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-345

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:lwip_project:lwip:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF209204-2C1F-4719-A910-B914C8B5B353",
            "versionEndIncluding": "1.4.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References