ByteOS Network

NVD Vulnerability Details :

CVE-2008-4099

Analyzed

Source-secalert@redhat.com

Published At-18 Sep, 2008 | 17:59

Updated At-19 Sep, 2008 | 04:00

PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.4	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:P

CPE Matches

Debian GNU/Linux

>>python-dns>>Versions up to 2.3.1-3(inclusive)

cpe:2.3:a:debian:python-dns:*:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-1

cpe:2.3:a:debian:python-dns:2.3.0-1:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-2

cpe:2.3:a:debian:python-dns:2.3.0-2:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-3

cpe:2.3:a:debian:python-dns:2.3.0-3:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-4

cpe:2.3:a:debian:python-dns:2.3.0-4:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-5

cpe:2.3:a:debian:python-dns:2.3.0-5:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-5.1

cpe:2.3:a:debian:python-dns:2.3.0-5.1:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.0-6

cpe:2.3:a:debian:python-dns:2.3.0-6:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.1-1

cpe:2.3:a:debian:python-dns:2.3.1-1:*:*:*:*:*:*:*

Debian GNU/Linux

>>python-dns>>2.3.1-2

cpe:2.3:a:debian:python-dns:2.3.1-2:*:*:*:*:*:*:*

Debian GNU/Linux

>>linux>>unknown

cpe:2.3:a:debian:linux:unknown:unknown:etch:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-16	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217	secalert@redhat.com	Exploit
http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog	secalert@redhat.com	N/A
http://www.openwall.com/lists/oss-security/2008/09/11/1	secalert@redhat.com	N/A
http://www.openwall.com/lists/oss-security/2008/09/16/4	secalert@redhat.com	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History