Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-3217

Overview

Vulnerability Score 6.8 6.8
CVE Id CVE-2008-3217
Last Modified 10 Sep 2008 09:12:08
Published 18 Jul 2008 12:41:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2008-3217

Summary

PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning. NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637.

Vulnerable Systems

Application

  • Powerdns Recursor 3.0

  • Powerdns Recursor 3.0.1

  • Powerdns Recursor 3.1.1

  • Powerdns Recursor 3.1.2

  • Powerdns Recursor 3.1.3

  • Powerdns Recursor 3.1.4

  • Powerdns Recursor 3.1.5


References

CONFIRM - http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/1179

FEDORA - FEDORA-2008-6893

XF - powerdns-recursor-rng-weak-security(43925)

BID - 30782

MLIST - [oss-security] 20080716 Re: CVE request: PowerDNS recursor source port randomization

MLIST - [oss-security] 20080710 Re: DNS vulnerability: other relevant software

MLIST - [oss-security] 20080709 CVE request: PowerDNS recursor source port randomization

SECUNIA - 31311

CONFIRM - http://doc.powerdns.com/changelog.html#CHANGELOG-RECURSOR-3-1-6


Last Updated: 27 May 2016 10:48:06