CVE-2008-4126

2008-09-1800:00:00

ubuntu.com

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

0.133 Low

EPSS

Percentile

95.6%

JSON

PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use
random source ports for DNS requests and does not use random transaction
IDs for DNS retries, which makes it easier for remote attackers to spoof
DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this
vulnerability exists because of an incomplete fix for CVE-2008-4099.

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchpython-dns< 2.3.0-5ubuntu1.2UNKNOWN
ubuntu7.04noarchpython-dns< 2.3.0-5.1ubuntu2.2UNKNOWN
ubuntu7.10noarchpython-dns< 2.3.1-1ubuntu0.2UNKNOWN
ubuntu8.04noarchpython-dns< 2.3.1-2ubuntu0.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	python-dns	< 2.3.0-5ubuntu1.2	UNKNOWN
ubuntu	7.04	noarch	python-dns	< 2.3.0-5.1ubuntu2.2	UNKNOWN
ubuntu	7.10	noarch	python-dns	< 2.3.1-1ubuntu0.2	UNKNOWN
ubuntu	8.04	noarch	python-dns	< 2.3.1-2ubuntu0.2	UNKNOWN