PT-2008-5403 · Gnu+1 · Gnu Adns+1

Tomas Hoger · Published 2008-09-18 · Updated 2023-02-13 · CVE-2008-4100

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU adns versions 1.4 and earlier

Description The issue allows remote attackers to spoof DNS responses due to the use of a fixed source port and sequential transaction IDs for DNS requests. This behavior is reported by the vendor as intended and compatible with the product's role in a trusted environment.

Recommendations For GNU adns versions 1.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-16

Related Identifiers

ALT-PU-2017-1591

CVE-2008-4100

Affected Products

Alt Linux

Gnu Adns

References · 11

• 🔥 https://exploit-db.com/exploits/6197 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2008-4100 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4100 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-4100 · Security Note
• https://osv.dev/vulnerability/CVE-2008-4100 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4100 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1591 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2008-4100 · Note
• http://openwall.com/lists/oss-security/2008/09/11/1 · Note
• http://openwall.com/lists/oss-security/2008/09/16/4 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698 · Note