CVE-2008-4100

CWE-168 documents8 sources
Severity
6.4MEDIUM
EPSS
0.6%
top 30.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Adns
Timeline
PublishedSep 18
Latest updateMay 2

Description

GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.

CVSS vector

AV:N/AC:L/C:N/I:P/A:PExploitability: 10.0 | Impact: 4.9

Affected Packages2 packages

▶Debianadns< 1.4-2+3
▶NVDgnu/adns1.4+13

🔴Vulnerability Details

3
GHSA
GHSA-qpj2-q7ff-rjvv: GNU adns 1↗2022-05-02
▶
CVEList
CVE-2008-4100: GNU adns 1↗2008-09-18
▶
OSV
CVE-2008-4100: GNU adns 1↗2008-09-18
▶

💥Exploits & PoCs

1
Exploit-DB
F5 Networks FirePass 4100 SSL VPN - 'installControl.php3' Cross-Site Scripting↗2008-04-23
▶

📋Vendor Advisories

2
Red Hat
adns: DNS spoofing flaw↗2008-09-11
▶
Debian
CVE-2008-4100: adns - GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-4100 adns: DNS spoofing flaw↗2008-09-18
▶