Unscored severity · published Sep 18, 2008
CVE-2008-4100
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different…
–
CVSS
1.5%
EPSS
No
On KEV
Description
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adns · Gnu
through 1.4; 0.1; 0.2; 0.3; 0.4; 0.5; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4100
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4100
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/09/11/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/09/16/4
www.exploit-db.com
https://www.exploit-db.com/exploits/6197
More from Adns
9.8
CVE-2017-9104
An issue was discovered in adns before 1.5.2
9.8
CVE-2017-9103
An issue was discovered in adns before 1.5.2
9.8
CVE-2017-9109
An issue was discovered in adns before 1.5.2
8.8
CVE-2017-9105
An issue was discovered in adns before 1.5.2
7.5
CVE-2017-9108
An issue was discovered in adns before 1.5.2