CVE-2008-1637
CVE-2008-1637
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
EPSS 4.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
pdns-recursor Debian:12
- Affected ranges
- ECOSYSTEM: < 3.1.7-1
Update to 3.1.7-1
pdns-recursor Debian:13
- Affected ranges
- ECOSYSTEM: < 3.1.7-1
Update to 3.1.7-1
pdns-recursor Debian:14
- Affected ranges
- ECOSYSTEM: < 3.1.7-1
Update to 3.1.7-1
Original sources
- http://secunia.com/advisories/29764
- http://secunia.com/advisories/29737
- http://www.debian.org/security/2008/dsa-1544
- https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00198.html
- http://www.securityfocus.com/bid/28517
- http://doc.powerdns.com/changelog.html
- http://www.trusteer.com/docs/powerdnsrecursor.html
- http://secunia.com/advisories/29584
- http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html
- http://www.vupen.com/english/advisories/2008/1046/references
- http://www.trusteer.com/docs/PowerDNS_recursor_DNS_Cache_Poisoning.pdf
- http://secunia.com/advisories/29830
- http://doc.powerdns.com/powerdns-advisory-2008-01.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41534
- http://security.gentoo.org/glsa/glsa-200804-22.xml
- https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00224.html
- http://www.securityfocus.com/archive/1/490330/100/0/threaded
- http://secunia.com/advisories/30581
- https://nvd.nist.gov/vuln/detail/CVE-2008-1637