CVEvulnerability
CVE-2008-4100
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-09-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-16
Description
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
Affected configurations
• gnu adns (<= 1.4)
• gnu adns 0.1
• gnu adns 0.2
• gnu adns 0.3
• gnu adns 0.4
• gnu adns 0.5
• gnu adns 0.6
• gnu adns 0.7
• gnu adns 0.8
• gnu adns 0.9
• gnu adns 1.0
• gnu adns 1.1
• gnu adns 1.2
• gnu adns 1.3
Related
Weakness · not in database (1)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698 bugs.debian.org
- http://www.openwall.com/lists/oss-security/2008/09/11/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2008/09/16/4 www.openwall.com
- https://www.exploit-db.com/exploits/6197 www.exploit-db.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698 bugs.debian.org
- http://www.openwall.com/lists/oss-security/2008/09/11/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2008/09/16/4 www.openwall.com
- https://www.exploit-db.com/exploits/6197 www.exploit-db.com