CVE-2008-1447

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 95%

from disclosure to weapon6254 days

Published on NVDJul 8

1st PoC+6254d

metasploit+13d

exploitation probability

95%top 1% of all CVEs

observed exploitation

nono source reports it

4 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Fixed

15 products (540 components)

Red Hat Enterprise Linux (v. 5 server) · Red Hat Enterprise Linux Desktop (v. 5 client) · Red Hat Enterprise Linux Desktop Workstation (v. 5 client) · Red Hat Enterprise Linux AS version 4 · Red Hat Enterprise Linux Desktop version 4 · and others 10

fix ↗

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

Affected products

n/a · n/a

public PoCs found — 4✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6122 cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6130 cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6123 githubgithub.com/hamlasiraj/metasploit-bailiwicked_domain-fix★ 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-009.txt.asc http://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01523520 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662368 http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html http://lists.apple.com/archives/security-announce//2008/Sep/msg00003.html http://lists.apple.com/archives/security-announce//2008/Sep/msg00004.html http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html