- Home
- CVEs with nessus.description==Multiple weaknesses have been identified in PyDNS, a DNS client
implementation for the Python language. Dan Kaminsky identified a
practical vector of DNS response spoofing and cache poisoning,
exploiting the limited entropy in a DNS transaction ID and lack of UDP
source port randomization in many DNS implementations. Scott Kitterman
noted that python-dns is vulnerable to this predictability, as it
randomizes neither its transaction ID nor its source port. Taken
together, this lack of entropy leaves applications using python-dns to
perform DNS queries highly susceptible to response forgery.
The Common Vulnerabilities and Exposures project identifies this class
of weakness as CVE-2008-1447 and this specific instance in PyDNS as
CVE-2008-4099
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top