Detections
Analytics
Multiple Vendor DNS Query ID Field Prediction Cache Poisoning
medium Nessus Plugin ID 33447
Language:
Synopsis
The remote name resolver (or the server it uses upstream) is affected by a DNS cache poisoning vulnerability.Description
The remote DNS resolver does not use random ports when making queries to third-party DNS servers. An unauthenticated, remote attacker can exploit this to poison the remote DNS server, allowing the attacker to divert legitimate traffic to arbitrary sites.Solution
Contact your DNS server vendor for a patch.See Also
https://www.cnet.com/news/massive-coordinated-dns-patch-released/
https://www.theregister.co.uk/2008/07/21/dns_flaw_speculation/
Plugin Details
Severity: Medium
ID: 33447
File Name: dns_non_random_source_ports.nasl
Version: 1.35
Type: remote
Family: DNS
Published: 7/9/2008
Updated: 4/3/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2008-1447
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Required KB Items: DNS/recursive_queries
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 7/8/2008
Reference Information
CVE: CVE-2008-1447
BID: 30131
CERT: 800113
IAVA: 2008-A-0045