Skip to content
OpenAdvisories
Unscored Public exploit CVE-2008-1447 EUVD-2008-1451GHSA-r5r9-27m2-2jg7

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2…

Published Jul 8, 2008 · Updated Aug 7, 2024 · Assigned by microsoft

Package: adns Package: bind9 Package: dnsmasq Package: dnspython Package: libnet-dns-perl Package: refpolicy Package: udns Ecosystem: Debian

Description

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 adns 1.4-2 —
Debian 14 bind9 1:9.5.0.dfsg-5 —
Debian 14 dnsmasq 2.43-1 —
Debian 14 dnspython 1.7.1-1 —
Debian 14 libnet-dns-perl 0.63-2 —
Debian 14 refpolicy 2:0.0.20080702-1 —
Debian 14 udns 0.2-1 —
Debian 13 adns 1.4-2 —
Debian 13 bind9 1:9.5.0.dfsg-5 —
Debian 13 dnsmasq 2.43-1 —
Debian 13 dnspython 1.7.1-1 —
Debian 13 libnet-dns-perl 0.63-2 —
Debian 13 refpolicy 2:0.0.20080702-1 —
Debian 13 udns 0.2-1 —
Debian 12 adns 1.4-2 —
Debian 12 bind9 1:9.5.0.dfsg-5 —
Debian 12 dnsmasq 2.43-1 —
Debian 12 dnspython 1.7.1-1 —
Debian 12 libnet-dns-perl 0.63-2 —
Debian 12 refpolicy 2:0.0.20080702-1 —
Debian 12 udns 0.2-1 —
Debian 5.0 bind9 1:9.4.2-10+lenny1 DTSA-147-1
Debian 4.0 bind9 1:9.3.4-2etch3 DSA-1603-1
Debian 4.0 dnsmasq 2.35-1+etch4 DSA-1623-1
Debian 4.0 python-dns 2.3.0-5.2+etch1 DSA-1619-1
Debian 4.0 refpolicy 0.0.20061018-5.1+etch1 DSA-1617-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 5 bind +7 30:9.3.4-6.0.2.P1.el5_2 RHSA-2008:0533
RHEL 5 dnsmasq 2.45-1.el5_2.1 RHSA-2008:0789
RHEL 5 selinux-policy +4 2.4.6-137.1.el5_2 RHSA-2008:0533
RHEL 4 bind +4 20:9.2.4-28.0.1.el4 RHSA-2008:0533
RHEL 4 selinux-policy-targeted +1 1.17.30-2.150.el4 RHSA-2008:0533
RHEL 3 bind +4 20:9.2.4-22.el3 RHSA-2008:0533
RHEL 2 bind +2 9.2.1-10.el2 RHSA-2008:0533

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 2 modules

Exploit-DB 3

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

References