CVE-2007-3377

Published: Jun 25, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.

Affected (64)

Products: Nlnet Labs: Net Dns

Nlnet Labs

1 product

Net Dns

Configuration A

64 vulnerable

Vulnerable Software	Affected Versions
Nlnet Labs Net Dns	Version 0.14
Nlnet Labs Net Dns	Version 0.20
Nlnet Labs Net Dns	Version 0.21
Nlnet Labs Net Dns	Version 0.22
Nlnet Labs Net Dns	Version 0.23
Nlnet Labs Net Dns	Version 0.24
Nlnet Labs Net Dns	Version 0.25
Nlnet Labs Net Dns	Version 0.26
Nlnet Labs Net Dns	Version 0.27
Nlnet Labs Net Dns	Version 0.28
Nlnet Labs Net Dns	Version 0.29
Nlnet Labs Net Dns	Version 0.30
Nlnet Labs Net Dns	Version 0.31
Nlnet Labs Net Dns	Version 0.32
Nlnet Labs Net Dns	Version 0.33
Nlnet Labs Net Dns	Version 0.34
Nlnet Labs Net Dns	Version 0.34_02
Nlnet Labs Net Dns	Version 0.34_03
Nlnet Labs Net Dns	Version 0.35
Nlnet Labs Net Dns	Version 0.36
Nlnet Labs Net Dns	Version 0.37
Nlnet Labs Net Dns	Version 0.38
Nlnet Labs Net Dns	Version 0.38_01
Nlnet Labs Net Dns	Version 0.38_02
Nlnet Labs Net Dns	Version 0.39
Nlnet Labs Net Dns	Version 0.39_01
Nlnet Labs Net Dns	Version 0.39_02
Nlnet Labs Net Dns	Version 0.40
Nlnet Labs Net Dns	Version 0.40_01
Nlnet Labs Net Dns	Version 0.41
Nlnet Labs Net Dns	Version 0.42
Nlnet Labs Net Dns	Version 0.42_01
Nlnet Labs Net Dns	Version 0.42_02
Nlnet Labs Net Dns	Version 0.43
Nlnet Labs Net Dns	Version 0.44
Nlnet Labs Net Dns	Version 0.44_01
Nlnet Labs Net Dns	Version 0.44_02
Nlnet Labs Net Dns	Version 0.45
Nlnet Labs Net Dns	Version 0.45_01
Nlnet Labs Net Dns	Version 0.46
Nlnet Labs Net Dns	Version 0.47
Nlnet Labs Net Dns	Version 0.47_01
Nlnet Labs Net Dns	Version 0.48
Nlnet Labs Net Dns	Version 0.48_01
Nlnet Labs Net Dns	Version 0.48_02
Nlnet Labs Net Dns	Version 0.48_03
Nlnet Labs Net Dns	Version 0.49
Nlnet Labs Net Dns	Version 0.49_01
Nlnet Labs Net Dns	Version 0.49_02
Nlnet Labs Net Dns	Version 0.49_03
Nlnet Labs Net Dns	Version 0.50
Nlnet Labs Net Dns	Version 0.51
Nlnet Labs Net Dns	Version 0.51_01
Nlnet Labs Net Dns	Version 0.51_02
Nlnet Labs Net Dns	Version 0.52
Nlnet Labs Net Dns	Version 0.53
Nlnet Labs Net Dns	Version 0.53_01
Nlnet Labs Net Dns	Version 0.53_02
Nlnet Labs Net Dns	Version 0.54
Nlnet Labs Net Dns	Version 0.55
Nlnet Labs Net Dns	Version 0.56
Nlnet Labs Net Dns	Version 0.57
Nlnet Labs Net Dns	Version 0.58
Nlnet Labs Net Dns	Version 0.59

References (62)

ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://osvdb.org/37053

Source: secalert@redhat.com

http://rt.cpan.org/Public/Bug/Display.html?id=23961

Source: secalert@redhat.com

http://secunia.com/advisories/25829

Source: secalert@redhat.com

http://secunia.com/advisories/26012

Source: secalert@redhat.com

http://secunia.com/advisories/26014

Source: secalert@redhat.com

http://secunia.com/advisories/26055

Source: secalert@redhat.com

http://secunia.com/advisories/26075

Source: secalert@redhat.com

http://secunia.com/advisories/26211

Source: secalert@redhat.com

http://secunia.com/advisories/26231

Source: secalert@redhat.com

http://secunia.com/advisories/26417

Source: secalert@redhat.com

http://secunia.com/advisories/26508

Source: secalert@redhat.com

http://secunia.com/advisories/26543

Source: secalert@redhat.com

http://secunia.com/advisories/29354

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2007-351.htm

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1515

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200708-06.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:146

Source: secalert@redhat.com

http://www.net-dns.org/docs/Changes.html

Source: secalert@redhat.com

http://www.nntp.perl.org/group/perl.qpsmtpd/2006/03/msg4810.html

Source: secalert@redhat.com

Exploit

http://www.novell.com/linux/security/advisories/2007_17_sr.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0674.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0675.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/473871/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/24669

Source: secalert@redhat.com

http://www.securitytracker.com/id?1018377

Source: secalert@redhat.com

http://www.trustix.org/errata/2007/0023/

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-483-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245458

Source: secalert@redhat.com

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/35112

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9904

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc (unsafe URL)