CVE-2000-0335
published 2000-05-03CVE-2000-0335: The resolver in glibc 2.1.3 uses predictable IDs, which allows a local attacker to spoof DNS query results.
PriorityP417high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.59%
73.0th percentile
The resolver in glibc 2.1.3 uses predictable IDs, which allows a local attacker to spoof DNS query results.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Predictable from Observable State
mitre_cwe
CWE-341 Predictable from Observable State
CWE-341: Predictable from Observable State
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Note: REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Common Consequences:
Scope: Other. Impact: Varies by Context. This weakness could be exploited by an attacker in a number ways depending on the context. If a predictable number is used to generate IDs or keys that are used within protection mechanisms, then an attacker could gain unauthorized access to the system. If predictable filenames are used for storing sensitive information, then an attacker might gain access
CWE
Predictable Exact Value from Previous Values
mitre_cwe·CVSS 6.4
[MEDIUM] CWE-342 Predictable Exact Value from Previous Values
CWE-342: Predictable Exact Value from Previous Values
An exact value or random number can be precisely predicted by observing previous values.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Other. Impact: Varies by Context.
Potential Mitigations:
Increase the entropy used to seed a PRNG.
[Architecture and Design] Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
[Implementation] Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.
Observed Examples:
CVE-2002-1463: Fi
2000-05-03
Published