Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-2926 — Bind vulnerability

11 documents10 sources
Severity
4.3MEDIUMNVD
EPSS
20.6%
top 4.42%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
ISC Bind9ISC Bind
Timeline
PublishedJul 24
Latest updateMay 3

Description

ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

â–¶Debianisc/bind9< 1:9.4.1-P1-1+3
â–¶NVDisc/bind7 versions+6

🔴Vulnerability Details

3
GHSA
GHSA-f6h8-pjrf-562j: ISC BIND 9 through 9↗2022-05-03
â–¶
OSV
CVE-2007-2926: ISC BIND 9 through 9↗2007-07-24
â–¶
CVEList
CVE-2007-2926: ISC BIND 9 through 9↗2007-07-24
â–¶

💥Exploits & PoCs

1
Exploit-DB
BIND 9 0.3beta - DNS Cache Poisoning↗2007-08-07
â–¶

📋Vendor Advisories

5
BSD
FreeBSD-SA-07:07.bind: Predictable query ids in named(8)↗2007-08-01
â–¶
Ubuntu
Bind vulnerability↗2007-07-25
â–¶
Red Hat
bind cryptographically weak query ids↗2007-07-23
â–¶
Debian
CVE-2007-2926: bind9 - ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation...↗2007
â–¶
Red Hat
CVE-2007-2930: The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8↗
â–¶

💬Community

1
Bugzilla
CVE-2007-2926 bind cryptographically weak query ids↗2007-07-19
â–¶
CVE-2007-2926 — ISC Bind vulnerability | cvebase