National Cyber Awareness System

Vulnerability Summary for CVE-2007-3377

Overview

Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245458

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245458

External Source: MISC

Name: http://www.nntp.perl.org/group/perl.qpsmtpd/2006/03/msg4810.html

Hyperlink:http://www.nntp.perl.org/group/perl.qpsmtpd/2006/03/msg4810.html

External Source: CONFIRM

Name: http://rt.cpan.org/Public/Bug/Display.html?id=23961

Hyperlink:http://rt.cpan.org/Public/Bug/Display.html?id=23961

External Source: OVAL

Name: oval:org.mitre.oval:def:9904

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9904

External Source: OSVDB

Name: 37053

Hyperlink:http://osvdb.org/37053

External Source: XF

Name: netdns-dns-responses-spoofing(35112)

Hyperlink:http://xforce.iss.net/xforce/xfdb/35112

External Source: UBUNTU

Name: USN-483-1

Hyperlink:http://www.ubuntu.com/usn/usn-483-1

External Source: TRUSTIX

Name: 2007-0023

Hyperlink:http://www.trustix.org/errata/2007/0023/

External Source: SECTRACK

Name: 1018377

Hyperlink:http://www.securitytracker.com/id?1018377

External Source: BID

Name: 24669

Hyperlink:http://www.securityfocus.com/bid/24669

External Source: BUGTRAQ

Name: 20070717 rPSA-2007-0142-1 perl-Net-DNS

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/473871/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0675

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0675.html

External Source: REDHAT

Name: RHSA-2007:0674

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0674.html

External Source: SUSE

Name: SUSE-SR:2007:017

Hyperlink:http://www.novell.com/linux/security/advisories/2007_17_sr.html

External Source: CONFIRM

Name: http://www.net-dns.org/docs/Changes.html

Hyperlink:http://www.net-dns.org/docs/Changes.html

External Source: MANDRIVA

Name: MDKSA-2007:146

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:146

External Source: GENTOO

Name: GLSA-200708-06

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200708-06.xml

External Source: DEBIAN

Name: DSA-1515

Hyperlink:http://www.debian.org/security/2008/dsa-1515

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2007-351.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2007-351.htm

External Source: SECUNIA

Name: 29354

Hyperlink:http://secunia.com/advisories/29354

External Source: SECUNIA

Name: 26543

Hyperlink:http://secunia.com/advisories/26543

External Source: SECUNIA

Name: 26508

Hyperlink:http://secunia.com/advisories/26508

External Source: SECUNIA

Name: 26417

Hyperlink:http://secunia.com/advisories/26417

External Source: SECUNIA

Name: 26231

Hyperlink:http://secunia.com/advisories/26231

External Source: SECUNIA

Name: 26211

Hyperlink:http://secunia.com/advisories/26211

External Source: SECUNIA

Name: 26075

Hyperlink:http://secunia.com/advisories/26075

External Source: SECUNIA

Name: 26055

Hyperlink:http://secunia.com/advisories/26055

External Source: SECUNIA

Name: 26014

Hyperlink:http://secunia.com/advisories/26014

External Source: SECUNIA

Name: 26012

Hyperlink:http://secunia.com/advisories/26012

External Source: SECUNIA

Name: 25829

Hyperlink:http://secunia.com/advisories/25829

External Source: SGI

Name: 20070701-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

References to Check Content

Identifier:oval:org.mitre.oval:def:9904

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9904