Unscored severity · published Sep 18, 2008
CVE-2008-4099
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof…
–
CVSS
2.3%
EPSS
No
On KEV
Description
PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
Python-dns · Debian
through 2.3.1-3; 2.3.0-1; 2.3.0-2; 2.3.0-3; 2.3.0-4; 2.3.0-5; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4099
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490217
packages.debian.org
http://packages.debian.org/changelogs/pool/main/p/python-dns/python-dns_2.3.3-1/changelog
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/09/11/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/09/16/4
More from Python-dns
–
CVE-2008-4126
PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it…