CVE-2008-4126
- State
- Published
- Severity
- Not scored
- Published
- Sep 18, 2008
- Updated
- Sep 16, 2024
- Reserved
- Sep 18, 2008
Description
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog
- [oss-security] 20080911 Re: CVE Request (ruby -- DNS spoofing vulnerability in resolv.rb)mailing-list
- [oss-security] 20080915 Re: CVE Request (ruby -- DNS spoofing vulnerability in resolv.rb)mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.