vulnwire
6.4med

CVE-2008-4392

dnscache in Daniel J.

Published 17 y ago · modified 4 mo ago · JSON

CVSS
6.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known

dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.

Exploit prediction (EPSS)

1.69% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.06.4AV:N/AC:L/Au:N/C:N/I:P/A:P

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

  • your.org /dnscache/djbdns.pdf · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/48807 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/33855 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/33818 · vdb-entry, x_refsource_BID, x_transferred
  • your.org /dnscache/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.