CVE

Id
31754  
CVE No.
CVE-2008-1637  
Status
Candidate  
Description
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.  
Phase
Assigned (20080402)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
341389 31754 CVE-2008-1637 BUGTRAQ:20080331 Paper by Amit Klein (Trusteer): "PowerDNS Recursor DNS Cache Poisoning [pharming]"  View
341390 31754 CVE-2008-1637 URL:http://www.securityfocus.com/archive/1/archive/1/490330/100/0/threaded  View
341391 31754 CVE-2008-1637 MISC:http://www.trusteer.com/docs/PowerDNS_recursor_DNS_Cache_Poisoning.pdf  View
341392 31754 CVE-2008-1637 MISC:http://www.trusteer.com/docs/powerdnsrecursor.html  View
341393 31754 CVE-2008-1637 CONFIRM:http://doc.powerdns.com/powerdns-advisory-2008-01.html  View
341394 31754 CVE-2008-1637 CONFIRM:http://doc.powerdns.com/changelog.html  View
341395 31754 CVE-2008-1637 DEBIAN:DSA-1544  View
341396 31754 CVE-2008-1637 URL:http://www.debian.org/security/2008/dsa-1544  View
341397 31754 CVE-2008-1637 FEDORA:FEDORA-2008-3010  View
341398 31754 CVE-2008-1637 URL:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00198.html  View
341399 31754 CVE-2008-1637 FEDORA:FEDORA-2008-3036  View
341400 31754 CVE-2008-1637 URL:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00224.html  View
341401 31754 CVE-2008-1637 GENTOO:GLSA-200804-22  View
341402 31754 CVE-2008-1637 URL:http://security.gentoo.org/glsa/glsa-200804-22.xml  View
341403 31754 CVE-2008-1637 SUSE:SUSE-SR:2008:012  View
341404 31754 CVE-2008-1637 URL:http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html  View
341405 31754 CVE-2008-1637 BID:28517  View
341406 31754 CVE-2008-1637 URL:http://www.securityfocus.com/bid/28517  View
341407 31754 CVE-2008-1637 VUPEN:ADV-2008-1046  View
341408 31754 CVE-2008-1637 URL:http://www.vupen.com/english/advisories/2008/1046/references  View
341409 31754 CVE-2008-1637 SECUNIA:29584  View
341410 31754 CVE-2008-1637 URL:http://secunia.com/advisories/29584  View
341411 31754 CVE-2008-1637 SECUNIA:29737  View
341412 31754 CVE-2008-1637 URL:http://secunia.com/advisories/29737  View
341413 31754 CVE-2008-1637 SECUNIA:29764  View
341414 31754 CVE-2008-1637 URL:http://secunia.com/advisories/29764  View
341415 31754 CVE-2008-1637 SECUNIA:29830  View
341416 31754 CVE-2008-1637 URL:http://secunia.com/advisories/29830  View
341417 31754 CVE-2008-1637 SECUNIA:30581  View
341418 31754 CVE-2008-1637 URL:http://secunia.com/advisories/30581  View
341419 31754 CVE-2008-1637 XF:powerdns-dnscache-weak-security(41534)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
47605 JVNDB-2008-002915 EfesTECH Video の default.asp における SQL インジェクションの脆弱性 EfesTECH Video の default.asp には、SQL インジェクションの脆弱性が存在します。 CVE-2008-1641 31754 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002915.html  View