CVE-2008-1447

high-risk
Published 2008-07-08

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

Do I need to act?

!
86.7% chance of exploitation in next 30 days
EPSS score — higher than 13% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
3 public exploits available
6122, 6130, 6123
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.8/10 Medium
NETWORK / HIGH complexity

Affected Products (3)

Affected Vendors

Isc

References (392)

Third Party Advisory ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc
Technical Description http://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked...
Third Party Advisory http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401
Broken Link http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01523520
Broken Link http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662368
Mailing List http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
Mailing List http://lists.apple.com/archives/security-announce//2008/Sep/msg00003.html
Mailing List http://lists.apple.com/archives/security-announce//2008/Sep/msg00004.html
Mailing List http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00003.html
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
Third Party Advisory http://marc.info/?l=bugtraq&m=121630706004256&w=2
Third Party Advisory http://marc.info/?l=bugtraq&m=121866517322103&w=2
Third Party Advisory http://marc.info/?l=bugtraq&m=123324863916385&w=2
Third Party Advisory http://marc.info/?l=bugtraq&m=141879471518471&w=2
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2008-0533.html
Third Party Advisory http://secunia.com/advisories/30925
Third Party Advisory http://secunia.com/advisories/30973
Third Party Advisory http://secunia.com/advisories/30977
and 372 more references
57
/ 100
high-risk
Severity 21/34 · High
Exploitability 27/34 · High
Exposure 9/34 · Low