CVEvulnerability

CVE-2007-3153

5.0 MEDIUM Published 2007-06-11 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2007-06-11
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values.

Affected configurations

• daniel stenberg c-ares 1.0 • daniel stenberg c-ares 1.1 • daniel stenberg c-ares 1.2 • daniel stenberg c-ares 1.2.1 • daniel stenberg c-ares 1.3 • daniel stenberg c-ares 1.3.1 • daniel stenberg c-ares 1.3.2

References

http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup cool.haxx.se
http://osvdb.org/37172 osvdb.org
http://www.securityfocus.com/bid/24386 www.securityfocus.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/34980 exchange.xforce.ibmcloud.com
http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup cool.haxx.se
http://osvdb.org/37172 osvdb.org
http://www.securityfocus.com/bid/24386 www.securityfocus.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/34980 exchange.xforce.ibmcloud.com