Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2008-1447

Опубликовано: 08 июл. 2008
Источник: nvd
CVSS3: 6.8
CVSS2: 5
EPSS Высокий

Описание

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*
cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:compute_cluster:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:datacenter:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:enterprise:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:standard:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:storage:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:x64:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:x64:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:x64:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:x64:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:x64:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:-:-:*:*:professional:*:x64:*
cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*

Одно из

cpe:2.3:a:isc:bind:4:*:*:*:*:*:*:*
cpe:2.3:a:isc:bind:8:*:*:*:*:*:*:*
cpe:2.3:a:isc:bind:9.2.9:*:*:*:*:*:*:*

EPSS

Процентиль: 99%
0.87602
Высокий

6.8 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-331

Связанные уязвимости

ubuntu логотип

CVE-2008-1447

CVSS3: 6.8
ubuntu
около 17 лет назад

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

redhat логотип

CVE-2008-1447

redhat
около 17 лет назад

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

debian логотип

CVE-2008-1447

CVSS3: 6.8
debian
около 17 лет назад

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, ...

github логотип

GHSA-r5r9-27m2-2jg7

CVSS3: 6.8
github
больше 3 лет назад

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

oracle-oval логотип

ELSA-2008-0789

oracle-oval
около 17 лет назад

ELSA-2008-0789: dnsmasq security update (MODERATE)

EPSS

Процентиль: 99%
0.87602
Высокий

6.8 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-331