CVE-2008-1447
published 2008-07-08CVE-2008-1447: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server…
PriorityP267medium6.8CVSS 3.1
AVNACHPRNUINSCCNIHAN
EXPLOIT
EPSS
95.18%
99.9th percentile
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Affected
192 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | bonjour | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios_ips | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect DNS cache poisoning attempts by monitoring for high-volume spoofed UDP DNS responses (port 53) with rapidly incrementing or brute-forced transaction IDs sent to a resolver from a single source IP, especially where the source IP spoofs a legitimate authoritative nameserver. ↗
- →Alert on DNS resolvers using static/predictable source ports for outbound recursive queries (SRCPORT fixed), as this dramatically reduces the entropy needed for a successful poisoning attack. ↗
- →Monitor DNS resolver caches for unexpected NS record changes for a target domain, particularly where the new NS entry does not match any previously observed authoritative nameserver. ↗
- →Detect the Kaminsky attack pattern: a flood of queries for random subdomains of a target domain (e.g., a<random>.example.com) originating from the same source, which is used to trigger resolver lookups that can be raced with spoofed responses. ↗
- →Check for DNS queries to spoofprobe or canary domains at red.metasploit.com, which are used by the Metasploit bailiwicked modules to fingerprint the resolver's source port before launching the poisoning attack. ↗
- →Correlate CVE-2008-1447 exploitation risk with CVE-2008-0166 (Debian weak SSL keys): OpenID Providers using weak TLS certificates combined with DNS cache poisoning make it impossible to rely on those providers for authentication. ↗
- ·The attack requires knowledge of the resolver's outbound source port. If the resolver uses randomized source ports (source port randomization / DNSSEC), the attack success probability drops dramatically. The exploit's own success formula shows that with fixed ports the full 16-bit TXID space (65536) must be guessed, but with a fixed source port the only entropy is the TXID. ↗
- ·The Metasploit bailiwicked_domain module uses an external Metasploit service (red.metasploit.com) to determine the resolver's source port before attacking; environments blocking outbound DNS to that service will prevent automatic source port detection. ↗
- ·The Python exploit (exploit-db 6123) is noted to be slow due to Python's performance characteristics, meaning real-world attack time may be significantly longer than C-based implementations. ↗
- ·The C exploit (exploit-db 6130) requires libdnet (libdumbnet-dev on Ubuntu) for raw packet sending; without this dependency the exploit cannot be compiled or run. ↗
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv6.8MEDIUM
vendor_cisco6.8MEDIUM
vendor_debian6.8LOW
vendor_redhat6.8MEDIUM
vendor_ubuntu6.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2008-10-10·CVSS 6.8
CVE-2008-3790 [MEDIUM] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Ruby vulnerabilities
Akira Tagoh discovered a vulnerability in Ruby which lead to an integer
overflow. If a user or automated system were tricked into running a
malicious script, an attacker could cause a denial of service or
possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2008-2376)
Laurent Gaffie discovered that Ruby did not properly check for memory
allocation failures. If a user or automated system were tricked into
running a malicious script, an attacker could cause a denial of
service. (CVE-2008-3443)
Keita Yamaguchi discovered several safe level vulnerabilities in Ruby.
An attacker could use this to bypass intended access restrictions.
(CVE-2008-3655)
Keita Yamaguchi discovered that WEBrick in Ruby
Cisco
Cisco IOS IPS Denial of Service Vulnerability
vendor_cisco·2008-09-24·CVSS 6.8
CVE-2008-2739 [MEDIUM] CWE-399 Cisco IOS IPS Denial of Service Vulnerability
Cisco IOS IPS Denial of Service Vulnerability
The Cisco IOS Intrusion Prevention System (IPS) feature contains a
vulnerability in the processing of certain IPS signatures that use the
SERVICE.DNS engine. This vulnerability may cause a router to crash or hang,
resulting in a denial of service condition.
Cisco has released software updates that address this vulnerability. There is a workaround for this vulnerability.
Note: This vulnerability is not related in any way to CVE-2008-1447 - Cache
poisoning attacks. Cisco Systems has published a Cisco Security Advisory for
that vulnerability, which can be found at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080708-dns.
This advisory is posted at
https://sec.cloudapps.cisco.com/security/center/con
Red Hat
adns: DNS spoofing flaw
vendor_redhat·2008-09-11·CVSS 6.8
CVE-2008-4100 [MEDIUM] adns: DNS spoofing flaw
adns: DNS spoofing flaw
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
Red Hat
python-pydns uses insecure DNS source ports
vendor_redhat·2008-09-11·CVSS 6.8
CVE-2008-4126 [MEDIUM] python-pydns uses insecure DNS source ports
python-pydns uses insecure DNS source ports
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.
Red Hat
python-PyDNS: insecure DNS transaction ids
vendor_redhat·2008-09-11·CVSS 6.8
CVE-2008-4099 [MEDIUM] python-PyDNS: insecure DNS transaction ids
python-PyDNS: insecure DNS transaction ids
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
VMware
Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.
vendor_vmware·2008-08-29·CVSS 1.9
CVE-2007-5269 [LOW] Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.
VMSA-2008-0014: Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.
I Security Issues a. Setting ActiveX killbit Starting from this release, VMware has set the killbit on its ActiveX controls. Setting the killbit ensures that ActiveX controls cannot run in Internet Explorer (IE), and avoids Microsoft KB article 240797 and the related references on this topic. Security vulnerabilities have been reported for ActiveX controls provided by VMware when run in IE. Under specific circumstances, exploitation of these ActiveX controls might result in denial-of- service or can allow running of arbitrary code when the user browses a malicious Web site or opens a malicious file i
Red Hat
ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
vendor_redhat·2008-08-08·CVSS 6.8
CVE-2008-3905 [MEDIUM] ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
Ubuntu
Dnsmasq vulnerability
vendor_ubuntu·2008-07-22
CVE-2008-1447 Dnsmasq vulnerability
Title: Dnsmasq vulnerability
Summary: Dnsmasq vulnerability
Dan Kaminsky discovered weaknesses in the DNS protocol as implemented
by Dnsmasq. A remote attacker could exploit this to spoof DNS entries
and poison DNS caches. Among other things, this could lead to
misdirected email and web traffic.
Instructions: After a standard system upgrade you need to restart Dnsmasq to effect
the necessary changes.
BSD
FreeBSD-SA-08:06.bind: DNS cache poisoning
bsd_advisories·2008-07-13·CVSS 6.8
CVE-2008-1447 [MEDIUM] FreeBSD-SA-08:06.bind: DNS cache poisoning
FreeBSD-SA-08:06.bind Security Advisory
The FreeBSD Project
Topic: DNS cache poisoning
Category: contrib
Module: bind
Announced: 2008-07-13
Credits: Dan Kaminsky
Affects: All supported FreeBSD versions.
Corrected: 2008-07-12 10:07:33 UTC (RELENG_6, 6.3-STABLE)
2008-07-13 18:42:38 UTC (RELENG_6_3, 6.3-RELEASE-p3)
2008-07-13 18:42:38 UTC (RELENG_7, 7.0-STABLE)
2008-07-13 18:42:38 UTC (RELENG_7_0, 7.0-RELEASE-p3)
CVE Name: CVE-2008-1447
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server. DNS requests
contain a query id which is used to
Red Hat
bind: implement source UDP port randomization (CERT VU#800113)
vendor_redhat·2008-07-08·CVSS 6.8
CVE-2008-1447 [MEDIUM] bind: implement source UDP port randomization (CERT VU#800113)
bind: implement source UDP port randomization (CERT VU#800113)
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Cisco
Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
vendor_cisco·2008-07-08·CVSS 6.4
CVE-2008-1447 [MEDIUM] CWE-310 Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
Multiple Cisco products are vulnerable to DNS cache poisoning attacks
due to their use of insufficiently randomized DNS transaction IDs and UDP
source ports in the DNS queries that they produce, which may allow an attacker
to more easily forge DNS answers that can poison DNS caches.
To exploit this vulnerability an attacker must be able to cause a
vulnerable DNS server to perform recursive DNS queries. Therefore, DNS servers
that are only authoritative, or servers where recursion is not allowed, are not
affected.
Cisco has released software updates that address these vulnerabilities.
This advisory is posted at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080708-dns.
This securi
Ubuntu
Bind vulnerability
vendor_ubuntu·2008-07-08
CVE-2008-1447 Bind vulnerability
Title: Bind vulnerability
Summary: Bind vulnerability
Dan Kaminsky discovered weaknesses in the DNS protocol as implemented
by Bind. A remote attacker could exploit this to spoof DNS entries and
poison DNS caches. Among other things, this could lead to misdirected
email and web traffic.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Debian
CVE-2008-3337: pdns - PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which mig...
vendor_debian·2008·CVSS 6.8
CVE-2008-3337 [MEDIUM] CVE-2008-3337: pdns - PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which mig...
PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.
Scope: local
bookworm: resolved (fixed in 2.9.21.1-1)
bullseye: resolved (fixed in 2.9.21.1-1)
forky: resolved (fixed in 2.9.21.1-1)
sid: resolved (fixed in 2.9.21.1-1)
trixie: resolved (fixed in 2.9.21.1-1)
Debian
CVE-2008-1447: adns - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, ...
vendor_debian·2008·CVSS 6.8
CVE-2008-1447 [MEDIUM] CVE-2008-1447: adns - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, ...
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Scope: local
bookworm: resolved (fixed in 1.4-2)
bullseye: resolved (fixed in 1.4-2)
forky: resolved (fixed in 1.4-2)
sid: resolved (fixed in 1.4-2)
trixie: resolved (fixed in 1.4-2)
Debian
CVE-2008-4100: adns - GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs...
vendor_debian·2008·CVSS 6.8
CVE-2008-4100 [MEDIUM] CVE-2008-4100: adns - GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs...
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
Scope: local
bookworm: resolved (fixed in 1.4-2)
bullseye: resolved (fixed in 1.4-2)
forky: resolved (fixed in 1.4-2)
sid: resolved (fixed in 1.4-2)
trixie: resolved (fixed in 1.4-2)
Cisco
Cisco IOS IPS Denial of Service Vulnerability
vendor_cisco
CVE-2008-2739 Cisco IOS IPS Denial of Service Vulnerability
CVE-2008-2739: Cisco IOS IPS Denial of Service Vulnerability
The Cisco IOS Intrusion Prevention System (IPS) feature contains a vulnerability in the processing of certain IPS signatures that use the SERVICE.DNS engine. This vulnerability may cause a router to crash or hang, resulting in a denial of service condition. Cisco has released software updates that address this vulnerability. There is a workaround for this vulnerability. Note: This vulnerability is not related in any way to CVE-2008-1447 - Cache poisoning attacks. Cisco Systems has published a Cisco Security Advisory for that vulnerability, which can be found at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080708-dns . This advisory is posted at https://sec.cloudapps.cisco.com/security/c
Red Hat
pdns: not responding invalid queries my simplify spoofing attacks
vendor_redhat·CVSS 6.8
CVE-2008-3337 [MEDIUM] pdns: not responding invalid queries my simplify spoofing attacks
pdns: not responding invalid queries my simplify spoofing attacks
PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.
Cisco
Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
vendor_cisco
CVE-2008-1447 Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
CVE-2008-1447: Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
Multiple Cisco products are vulnerable to DNS cache poisoning attacks due to their use of insufficiently randomized DNS transaction IDs and UDP source ports in the DNS queries that they produce, which may allow an attacker to more easily forge DNS answers that can poison DNS caches. To exploit this vulnerability an attacker must be able to cause a vulnerable DNS server to perform recursive DNS queries. Therefore, DNS servers that are only authoritative, or servers where recursion is not allowed, are not affected. Cisco has released software updates that address these vulnerabilities. This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080708-dns .
GHSA
GHSA-qxw9-5pqg-5rq6: ipnat in IP Filter in Sun Solaris 10 and OpenSolaris before snv_96, when running on a DNS server with Network Address Translation (NAT) configured, im
ghsa_unreviewed·2022-05-17·CVSS 6.8
CVE-2008-5133 [MEDIUM] GHSA-qxw9-5pqg-5rq6: ipnat in IP Filter in Sun Solaris 10 and OpenSolaris before snv_96, when running on a DNS server with Network Address Translation (NAT) configured, im
ipnat in IP Filter in Sun Solaris 10 and OpenSolaris before snv_96, when running on a DNS server with Network Address Translation (NAT) configured, improperly changes the source port of a packet when the destination port is the DNS port, which allows remote attackers to bypass an intended CVE-2008-1447 protection mechanism and spoof the responses to DNS queries sent by named.
GHSA
GHSA-r5r9-27m2-2jg7: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9
ghsa_unreviewed·2022-05-03
CVE-2008-1447 [MEDIUM] CWE-331 GHSA-r5r9-27m2-2jg7: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
GHSA
GHSA-x9xp-g2q8-6p6h: PyDNS (aka python-dns) before 2
ghsa_unreviewed·2022-05-02·CVSS 6.8
CVE-2008-4126 [MEDIUM] GHSA-x9xp-g2q8-6p6h: PyDNS (aka python-dns) before 2
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.
GHSA
GHSA-9547-8gx6-787g: PyDNS (aka python-dns) before 2
ghsa_unreviewed·2022-05-02·CVSS 6.8
CVE-2008-4099 [MEDIUM] GHSA-9547-8gx6-787g: PyDNS (aka python-dns) before 2
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
GHSA
GHSA-vwcj-mf69-7rfw: resolv
ghsa_unreviewed·2022-05-02·CVSS 6.8
CVE-2008-3905 [MEDIUM] CWE-287 GHSA-vwcj-mf69-7rfw: resolv
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
GHSA
GHSA-93cc-m3wp-rrvv: mDNSResponder in Apple Bonjour for Windows before 1
ghsa_unreviewed·2022-05-02·CVSS 6.8
CVE-2008-3630 [MEDIUM] GHSA-93cc-m3wp-rrvv: mDNSResponder in Apple Bonjour for Windows before 1
mDNSResponder in Apple Bonjour for Windows before 1.0.5, when an application uses the Bonjour API for unicast DNS, does not choose random values for transaction IDs or source ports in DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
GHSA
GHSA-qpj2-q7ff-rjvv: GNU adns 1
ghsa_unreviewed·2022-05-02·CVSS 6.8
CVE-2008-4100 [MEDIUM] GHSA-qpj2-q7ff-rjvv: GNU adns 1
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
GHSA
GHSA-vrc4-g858-6v5j: Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache pois
ghsa_unreviewed·2022-05-01·CVSS 6.8
CVE-2008-1454 [MEDIUM] GHSA-vrc4-g858-6v5j: Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache pois
Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting "records from a response that is outside the remote server's authority," aka "DNS Cache Poisoning Vulnerability," a different vulnerability than CVE-2008-1447.
GHSA
GHSA-3x69-mjh4-vwh4: The SERVICE
ghsa_unreviewed·2022-05-01·CVSS 6.8
CVE-2008-2739 [MEDIUM] GHSA-3x69-mjh4-vwh4: The SERVICE
The SERVICE.DNS signature engine in the Intrusion Prevention System (IPS) in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device crash or hang) via network traffic that triggers unspecified IPS signatures, a different vulnerability than CVE-2008-1447.
GHSA
GHSA-rj9p-mrcp-3f7h: PowerDNS Authoritative Server before 2
ghsa_unreviewed·2022-05-01·CVSS 6.8
CVE-2008-3337 [MEDIUM] CWE-20 GHSA-rj9p-mrcp-3f7h: PowerDNS Authoritative Server before 2
PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.
GHSA
GHSA-cq23-cxpr-f49x: It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number
ghsa_unreviewed·2022-04-21·CVSS 7.5
CVE-2008-3280 [HIGH] CWE-338 GHSA-cq23-cxpr-f49x: It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
OSV
CVE-2008-4100: GNU adns 1
osv·2008-09-18·CVSS 6.8
CVE-2008-4100 [MEDIUM] CVE-2008-4100: GNU adns 1
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
OSV
CVE-2008-4099: PyDNS (aka python-dns) before 2
osv·2008-09-18·CVSS 6.8
CVE-2008-4099 [MEDIUM] CVE-2008-4099: PyDNS (aka python-dns) before 2
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
OSV
CVE-2008-3337: PowerDNS Authoritative Server before 2
osv·2008-08-08·CVSS 6.8
CVE-2008-3337 [MEDIUM] CVE-2008-3337: PowerDNS Authoritative Server before 2
PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.
OSV
CVE-2008-1447: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9
osv·2008-07-08·CVSS 6.8
CVE-2008-1447 [MEDIUM] CVE-2008-1447: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
No detection rules found.
Exploit-DB
BIND 9.x - Remote DNS Cache Poisoning
exploitdb·2008-07-25·CVSS 6.8
CVE-2008-4194 [MEDIUM] BIND 9.x - Remote DNS Cache Poisoning
BIND 9.x - Remote DNS Cache Poisoning
---
/*
* Exploit for CVE-2008-1447 - Kaminsky DNS Cache Poisoning Attack
*
* Compilation:
* $ gcc -o kaminsky-attack kaminsky-attack.c `dnet-config --libs` -lm
*
* Dependency: libdnet (aka libdumbnet-dev under Ubuntu)
*
* Author: marc.bevand at rapid7 dot com
*/
#define _BSD_SOURCE
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define DNSF_RESPONSE (1 size)
fprintf(stderr, "format_domain overflow\n"), exit(1);
buf[bufi++] = i - j;
memcpy(buf + bufi, name + j, i - j);
bufi += i - j;
j = i + 1;
}
i++;
}
if (bufi + 1 + 2 + 2 > size)
fprintf(stderr, "format_domain overflow\n"), exit(1);
buf[bufi++] = 0;
*len = bufi;
}
void format_qr(u_char *buf, unsigned size, unsigned *len, const char *name, uint16_t type, uint16_t
Exploit-DB
BIND 9.x - Remote DNS Cache Poisoning
exploitdb·2008-07-24·CVSS 6.8
CVE-2008-4194 [MEDIUM] BIND 9.x - Remote DNS Cache Poisoning
BIND 9.x - Remote DNS Cache Poisoning
---
from scapy import *
import random
# Copyright (C) 2008 Julien Desfossez
# http://www.solisproject.net/
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temp
Exploit-DB
BIND 9.4.1 < 9.4.2 - Remote DNS Cache Poisoning (Metasploit)
exploitdb·2008-07-23
CVE-2008-4194 BIND 9.4.1 < 9.4.2 - Remote DNS Cache Poisoning (Metasploit)
BIND 9.4.1
H D Moore
===============/========================================================
Description
This exploit targets a fairly ubiquitous flaw in DNS implementations
which allow the insertion of malicious DNS records into the cache of the
target nameserver. This exploit caches a single malicious nameserver
entry into the target nameserver which replaces the legitimate
nameservers for the target domain. By causing the target nameserver to
query for random hostnames at the target domain, the attacker can spoof
a response to the target server including an answer for the query, an
authority server record, and an additional record for that server,
causing target nameserver to insert the additional record into the
cache. This insertion completely replaces the original nameserver
recor
Metasploit
DNS BailiWicked Domain Attack
metasploit
DNS BailiWicked Domain Attack
DNS BailiWicked Domain Attack
This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed ~Jul 2008. This exploit replaces the target domains nameserver entries in a vulnerable DNS cache server. This attack works by sending random hostname queries to the target DNS server coupled with spoofed replies to those queries from the authoritative nameservers for that domain. Eventually, a guessed ID will match, the spoofed packet will get accepted, and the nameserver entries for the target domain will be replaced by the server specified in the NEWDNS option of this exploit.
Metasploit
DNS BailiWicked Host Attack
metasploit
DNS BailiWicked Host Attack
DNS BailiWicked Host Attack
This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed ~Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random hostname queries to the target DNS server coupled with spoofed replies to those queries from the authoritative nameservers for that domain. Eventually, a guessed ID will match, the spoofed packet will get accepted, and due to the additional hostname entry being within bailiwick constraints of the original request the malicious host entry will get cached.
Bugzilla
CVE-2008-4100 adns: DNS spoofing flaw
bugzilla·2008-09-18·CVSS 6.8
CVE-2008-4100 [MEDIUM] CVE-2008-4100 adns: DNS spoofing flaw
CVE-2008-4100 adns: DNS spoofing flaw
GNU adns 1.4 and earlier uses a fixed source port and sequential
transaction IDs for DNS requests, which makes it easier for remote
attackers to spoof DNS responses, a different vulnerability than
CVE-2008-1447. NOTE: the vendor reports that this is intended behavior
and is compatible with the product's intended role in a trusted
environment.
Reference: URL:http://www.milw0rm.com/exploits/6197
Reference: URL:http://www.openwall.com/lists/oss-security/2008/09/11/1
Reference: URL:http://www.openwall.com/lists/oss-security/2008/09/16/4
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698
Discussion:
The upstream INSTALL document states:
SECURITY AND PERFORMANCE - AN IMPORTANT NOTE
adns is not a `full-service resolver': it does
Bugzilla
CVE-2008-4099 python-PyDNS: insecure DNS transaction ids
bugzilla·2008-09-18·CVSS 6.8
CVE-2008-4099 [MEDIUM] CVE-2008-4099 python-PyDNS: insecure DNS transaction ids
CVE-2008-4099 python-PyDNS: insecure DNS transaction ids
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use
random source ports or transaction IDs for DNS requests, which makes
it easier for remote attackers to spoof DNS responses, a different
vulnerability than CVE-2008-1447.
Discussion:
Created python-pydns tracking bugs for this issue
Affects: F8 [bug #462765]
Affects: F9 [bug #462766]
Affects: Fdevel [bug #462767]
Affects: epel-5 [bug #462768]
---
Current Fedora and EPEL have 2.3.3, so this is no longer an issue there.
Bugzilla
CVE-2008-4126 python-pydns uses insecure DNS source ports
bugzilla·2008-09-18·CVSS 6.8
CVE-2008-4126 [MEDIUM] CVE-2008-4126 python-pydns uses insecure DNS source ports
CVE-2008-4126 python-pydns uses insecure DNS source ports
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use
random source ports for DNS requests and does not use random
transaction IDs for DNS retries, which makes it easier for remote
attackers to spoof DNS responses, a different vulnerability than
CVE-2008-1447. NOTE: this vulnerability exists because of an
incomplete fix for CVE-2008-4099.
Discussion:
We currently do not ship any PyDNS version affected by the issue described in this CVE - there's either 2.3.0 in F8/F9 that is affected by the original issue (CVE-2008-4099), or 2.3.3 in Rawhide, which contains complete upstream fix.
Hence I'm closing this bug, only original issue needs to be tracked.
Bugzilla
CVE-2008-3905 ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
bugzilla·2008-09-08·CVSS 6.8
CVE-2008-3905 [MEDIUM] CVE-2008-3905 ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
CVE-2008-3905 ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3905 to the following vulnerability:
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7
before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential
transaction IDs and constant source ports for DNS requests, which
makes it easier for remote attackers to spoof DNS responses, a
different vulnerability than CVE-2008-1447.
References:
http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/
http://www.openwall.com/lists/oss-security/2008/09/04/9
Upstream patch:
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=18424
Discussion:
ruby-1.8.6.287-2.fc8 has been pus
Bugzilla
CVE-2008-3323 Cygwin installation and update process can be subverted
bugzilla·2008-06-04·CVSS 7.6
CVE-2008-3323 [HIGH] CVE-2008-3323 Cygwin installation and update process can be subverted
CVE-2008-3323 Cygwin installation and update process can be subverted
Derek Callaway from Security Objectives contacted the Red Hat Security Response
Team on 25th May 2008 to report a security issue with Cygwin.
"Tarball software packages are installed and updated via setup.exe. This program
downloads a package list and packages from mirrors over plaintext HTTP or FTP.
The package list contains MD5 checksums for verifying package integrity. If a
rogue server answers the HTTP request responsible for package updates and
responds with a modified MD5 string setup.exe will download and install a
malicious package."
He included a proof-of-concept and stated that he notified vulnerability
co-coordinator iDefense about this issue. iDefense responded that they did not
consider this a vulnerabili
Bugzilla
CVE-2008-1447 bind: implement source UDP port randomization (CERT VU#800113)
bugzilla·2008-06-02·CVSS 6.8
CVE-2008-1447 [MEDIUM] CVE-2008-1447 bind: implement source UDP port randomization (CERT VU#800113)
CVE-2008-1447 bind: implement source UDP port randomization (CERT VU#800113)
Created attachment 308453
proposed patch, ready for backporting
Here is their patch against 9.3.5 (they didn't supply a patch, just 9.3.5-p1
which I compared against 9.3.5 and removed all the makefile/windows build
noise)
Discussion:
fix CVE name typo, correct CVE is CVE-2008-1447.
---
The DNS protocol protects against spoofing attacks by requiring an attacker
to predict both the DNS transaction ID and UDP source port of a request.
In the last few years a number of papers have found problems with DNS
implementations making it easier for an attacker to perform DNS cache
poisoning attacks.
Previous versions of BIND did not use randomized UDP source ports which
could make DNS cache poisoning attacks easier if
arXiv
Generative Artificial Intelligence-Supported Pentesting: A Comparison between Claude Opus, GPT-4, and Copilot
arxiv_fulltext·2025-08-26
Generative Artificial Intelligence-Supported Pentesting: A Comparison between Claude Opus, GPT-4, and Copilot
[Article Title]Generative Artificial Intelligence-Supported Pentesting: A Comparison between Claude Opus, GPT-4, and Copilot
[1]Antonio López Martí[email protected]
[2]Alejandro [email protected]
*[1]Antonio Ruiz-Martí[email protected]
*[1]Department of Information and Communication Engineering, University of Murcia, Faculty of Computer Science, Espinardo, 30100, Murcia, Spain
[2]Legitec, Avda. de los Rectores nº 2-4 bajo,
Espinardo, 30100, Murcia, Spain
The advent of Generative Artificial Intelligence (GenAI) has brought a significant change to our society. GenAI can be applied across numerous fields, with particular relevance in cybersecurity. Among the various areas of application, its use in penetration testing (pentesting) or ethical hacking processes is of special interest
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.aschttp://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked.htmlhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01523520http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662368http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.htmlhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00003.htmlhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00004.htmlhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00005.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-07/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.htmlhttp://marc.info/?l=bugtraq&m=121630706004256&w=2http://marc.info/?l=bugtraq&m=121866517322103&w=2http://marc.info/?l=bugtraq&m=123324863916385&w=2http://marc.info/?l=bugtraq&m=141879471518471&w=2http://rhn.redhat.com/errata/RHSA-2008-0533.htmlhttp://secunia.com/advisories/30925http://secunia.com/advisories/30973http://secunia.com/advisories/30977http://secunia.com/advisories/30979http://secunia.com/advisories/30980http://secunia.com/advisories/30988http://secunia.com/advisories/30989http://secunia.com/advisories/30998http://secunia.com/advisories/31011http://secunia.com/advisories/31012http://secunia.com/advisories/31014http://secunia.com/advisories/31019http://secunia.com/advisories/31022http://secunia.com/advisories/31030http://secunia.com/advisories/31031http://secunia.com/advisories/31033http://secunia.com/advisories/31052http://secunia.com/advisories/31065http://secunia.com/advisories/31072http://secunia.com/advisories/31093http://secunia.com/advisories/31094http://secunia.com/advisories/31137http://secunia.com/advisories/31143http://secunia.com/advisories/31151http://secunia.com/advisories/31152http://secunia.com/advisories/31153http://secunia.com/advisories/31169http://secunia.com/advisories/31197http://secunia.com/advisories/31199http://secunia.com/advisories/31204http://secunia.com/advisories/31207http://secunia.com/advisories/31209http://secunia.com/advisories/31212http://secunia.com/advisories/31213http://secunia.com/advisories/31221http://secunia.com/advisories/31236http://secunia.com/advisories/31237http://secunia.com/advisories/31254http://secunia.com/advisories/31326http://secunia.com/advisories/31354http://secunia.com/advisories/31422http://secunia.com/advisories/31430http://secunia.com/advisories/31451http://secunia.com/advisories/31482http://secunia.com/advisories/31495http://secunia.com/advisories/31588http://secunia.com/advisories/31687http://secunia.com/advisories/31823http://secunia.com/advisories/31882http://secunia.com/advisories/31900http://secunia.com/advisories/33178http://secunia.com/advisories/33714http://secunia.com/advisories/33786http://security.freebsd.org/advisories/FreeBSD-SA-08:06.bind.aschttp://security.gentoo.org/glsa/glsa-200807-08.xmlhttp://security.gentoo.org/glsa/glsa-200812-17.xmlhttp://security.gentoo.org/glsa/glsa-201209-25.xmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.452680http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.539239http://sunsolve.sun.com/search/document.do?assetkey=1-26-239392-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-240048-1http://support.apple.com/kb/HT3026http://support.apple.com/kb/HT3129http://support.citrix.com/article/CTX117991http://support.citrix.com/article/CTX118183http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=762152http://up2date.astaro.com/2008/08/up2date_7202_released.htmlhttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0231http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018http://www.bluecoat.com/support/security-advisories/dns_cache_poisoninghttp://www.caughq.org/exploits/CAU-EX-2008-0002.txthttp://www.caughq.org/exploits/CAU-EX-2008-0003.txthttp://www.cisco.com/en/US/products/products_security_advisory09186a00809c2168.shtmlhttp://www.debian.org/security/2008/dsa-1603http://www.debian.org/security/2008/dsa-1604http://www.debian.org/security/2008/dsa-1605http://www.debian.org/security/2008/dsa-1619http://www.debian.org/security/2008/dsa-1623http://www.doxpara.com/?p=1176http://www.doxpara.com/DMK_BO2K8.ppthttp://www.ibm.com/support/docview.wss?uid=isg1IZ26667http://www.ibm.com/support/docview.wss?uid=isg1IZ26668http://www.ibm.com/support/docview.wss?uid=isg1IZ26669
+ 292 more references
2008-07-08
Published