Unrated severityNVD Advisory· Published Apr 2, 2008· Updated Apr 23, 2026
CVE-2008-1637
CVE-2008-1637
Description
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
18- doc.powerdns.com/powerdns-advisory-2008-01.htmlnvdExploitPatch
- secunia.com/advisories/29584nvdExploitVendor Advisory
- www.trusteer.com/docs/PowerDNS_recursor_DNS_Cache_Poisoning.pdfnvdExploit
- www.trusteer.com/docs/powerdnsrecursor.htmlnvdExploit
- doc.powerdns.com/changelog.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.htmlnvd
- secunia.com/advisories/29737nvd
- secunia.com/advisories/29764nvd
- secunia.com/advisories/29830nvd
- secunia.com/advisories/30581nvd
- security.gentoo.org/glsa/glsa-200804-22.xmlnvd
- www.debian.org/security/2008/dsa-1544nvd
- www.securityfocus.com/archive/1/490330/100/0/threadednvd
- www.securityfocus.com/bid/28517nvd
- www.vupen.com/english/advisories/2008/1046/referencesnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/41534nvd
- www.redhat.com/archives/fedora-package-announce/2008-April/msg00198.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2008-April/msg00224.htmlnvd
News mentions
0No linked articles in our index yet.