CVE-2008-4099

PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
debianpython-dns
𝑥
≤ 2.3.1-3
debianpython-dns
2.3.0-1
debianpython-dns
2.3.0-2
debianpython-dns
2.3.0-3
debianpython-dns
2.3.0-4
debianpython-dns
2.3.0-5
debianpython-dns
2.3.0-5.1
debianpython-dns
2.3.0-6
debianpython-dns
2.3.1-1
debianpython-dns
2.3.1-2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-dns
oneiric
not-affected
natty
not-affected
maverick
not-affected
lucid
not-affected
karmic
not-affected
jaunty
not-affected
intrepid
not-affected
hardy
ignored
gutsy
ignored
feisty
ignored
dapper
ignored
Common Weakness Enumeration
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217
http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog
http://www.openwall.com/lists/oss-security/2008/09/11/1
http://www.openwall.com/lists/oss-security/2008/09/16/4
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217
http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog
http://www.openwall.com/lists/oss-security/2008/09/11/1
http://www.openwall.com/lists/oss-security/2008/09/16/4