Vulnerabilities > CVE-2008-1637 - Numeric Errors vulnerability in Powerdns Recursor

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-3036.NASL
    description - Bug #440247 - CVE-2008-1637 pdns-recursor: perdictable query ids Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31827
    published2008-04-11
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31827
    titleFedora 8 : pdns-recursor-3.1.5-1.fc8 (2008-3036)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2008-3036.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31827);
      script_version ("1.13");
      script_cvs_date("Date: 2019/08/02 13:32:27");
    
      script_cve_id("CVE-2008-1637");
      script_xref(name:"FEDORA", value:"2008-3036");
    
      script_name(english:"Fedora 8 : pdns-recursor-3.1.5-1.fc8 (2008-3036)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Bug #440247 - CVE-2008-1637 pdns-recursor: perdictable
        query ids
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=440247"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2008-April/009249.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2143c232"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected pdns-recursor package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:pdns-recursor");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:8");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/04/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/11");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 8.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC8", reference:"pdns-recursor-3.1.5-1.fc8")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "pdns-recursor");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_PDNS-5242.NASL
    descriptionpdns used predictable random numbers for DNS responses. Therfore attackers could generate spoofed DNS responses (CVE-2008-1637).
    last seen2020-06-01
    modified2020-06-02
    plugin id33089
    published2008-06-04
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33089
    titleopenSUSE 10 Security Update : pdns (pdns-5242)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update pdns-5242.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(33089);
      script_version ("1.10");
      script_cvs_date("Date: 2019/10/25 13:36:33");
    
      script_cve_id("CVE-2008-1637");
    
      script_name(english:"openSUSE 10 Security Update : pdns (pdns-5242)");
      script_summary(english:"Check for the pdns-5242 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "pdns used predictable random numbers for DNS responses. Therfore
    attackers could generate spoofed DNS responses (CVE-2008-1637)."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected pdns package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:pdns");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/05/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/06/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.1", reference:"pdns-2.9.19-13.7") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "pdns");
    }
    
  • NASL familyDNS
    NASL idPDNS_RECURSOR_CACHE_POISINING.NASL
    descriptionAccording to its self-reported version number, the version of PowerDNS Recursor listening on the remote host is version 3.x prior to 3.1.6. It is, therefore, affected by a cache poisoning vulnerability due to insufficient randomness to calculate TRXID values and UDP source port numbers. A remote attacker can exploit this poison the DNS cache. This vulnerability was originally fixed in version 3.1.5, but a more secure method was implemented in version 3.1.6. Note that Nessus has not attempted to exploit this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id34044
    published2008-08-25
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34044
    titlePowerDNS Recursor 3.x < 3.1.6 DNS Predictable Transaction ID (TRXID) Cache Poisoning
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
     script_id(34044);
     script_version("1.17");
     script_cvs_date("Date: 2018/07/24 18:56:11");
    
     script_cve_id("CVE-2008-1637", "CVE-2008-3217");
     script_bugtraq_id(28517, 30782);
    
     script_name(english:"PowerDNS Recursor 3.x < 3.1.6 DNS Predictable Transaction ID (TRXID) Cache Poisoning");
     script_summary(english:"Checks the version of PowerDNS Recursor.");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote name server is affected by a cache poisoning vulnerability.");
     script_set_attribute(attribute:"description", value:
    "According to its self-reported version number, the version of PowerDNS
    Recursor listening on the remote host is version 3.x prior to 3.1.6.
    It is, therefore, affected by a cache poisoning vulnerability due to
    insufficient randomness to calculate TRXID values and UDP source port
    numbers. A remote attacker can exploit this poison the DNS cache. This
    vulnerability was originally fixed in version 3.1.5, but a more secure
    method was implemented in version 3.1.6.
    
    Note that Nessus has not attempted to exploit this issue but has
    instead relied only on the application's self-reported version number.
    Also, Nessus has not checked for the presence of the patch or the
    workaround.");
     script_set_attribute(attribute:"see_also", value:"https://doc.powerdns.com/md/changelog/#recursor-version-316");
     script_set_attribute(attribute:"see_also", value:"https://doc.powerdns.com/md/security/powerdns-advisory-2008-01/");
     script_set_attribute(attribute:"solution", value:
    "Upgrade to PowerDNS recursor 3.1.6 or later. Alternatively, apply the
    patch referenced in the vendor advisory..");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
     script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"false");
     script_cwe_id(189);
    
     script_set_attribute(attribute:"vuln_publication_date", value:"2008/03/31");
     script_set_attribute(attribute:"patch_publication_date", value:"2008/03/31");
     script_set_attribute(attribute:"plugin_publication_date", value:"2008/08/25");
    
     script_set_attribute(attribute:"potential_vulnerability", value:"true");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:powerdns:powerdns");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:powerdns:recursor");
     script_set_attribute(attribute:"plugin_type", value:"remote");
     script_end_attributes();
    
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
     script_family(english:"DNS");
    
     script_dependencies("pdns_version.nasl");
     script_require_keys("pdns/version", "pdns/version_full", "pdns/version_source", "Settings/ParanoidReport");
    
     exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    app_name = "PowerDNS Recursor";
    version_source = get_kb_item_or_exit("pdns/version_source");
    version_full = get_kb_item_or_exit("pdns/version_full");
    version = get_kb_item_or_exit("pdns/version");
    type = get_kb_item_or_exit("pdns/type");
    
    if (version == UNKNOWN_VER) audit(AUDIT_UNKNOWN_APP_VER, app_name);
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    fix = '3.1.6';
    port = 53;
    
    if (type != 'recursor')
      audit(AUDIT_NOT_LISTEN, "PowerDNS Recursor", port, "UDP");
    
    
    if (version !~ "^3\." || ver_compare(ver:version, fix:fix, strict:FALSE) >= 0)
      audit(AUDIT_LISTEN_NOT_VULN, app_name, port, version_full, "UDP");
    
    if (report_verbosity > 0)
    {
      report =
        '\n  Version source    : ' + version_source +
        '\n  Installed version : ' + version_full +
        '\n  Fixed version     : ' + fix +
        '\n';
      security_warning(port:port, proto:"udp", extra:report);
    }
    else security_warning(port:port, proto:"udp");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200804-22.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200804-22 (PowerDNS Recursor: DNS Cache Poisoning) Amit Klein of Trusteer reported that insufficient randomness is used to calculate the TRXID values and the UDP source port numbers (CVE-2008-1637). Thomas Biege of SUSE pointed out that a prior fix to resolve this issue was incomplete, as it did not always enable the stronger random number generator for source port selection (CVE-2008-3217). Impact : A remote attacker could send malicious answers to insert arbitrary DNS data into the cache. These attacks would in turn help an attacker to perform man-in-the-middle and site impersonation attacks. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id32015
    published2008-04-22
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/32015
    titleGLSA-200804-22 : PowerDNS Recursor: DNS Cache Poisoning
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200804-22.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(32015);
      script_version("1.13");
      script_cvs_date("Date: 2019/08/02 13:32:44");
    
      script_cve_id("CVE-2008-1637", "CVE-2008-3217");
      script_xref(name:"GLSA", value:"200804-22");
    
      script_name(english:"GLSA-200804-22 : PowerDNS Recursor: DNS Cache Poisoning");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200804-22
    (PowerDNS Recursor: DNS Cache Poisoning)
    
        Amit Klein of Trusteer reported that insufficient randomness is used to
        calculate the TRXID values and the UDP source port numbers
        (CVE-2008-1637). Thomas Biege of SUSE pointed out that a prior fix to
        resolve this issue was incomplete, as it did not always enable the
        stronger random number generator for source port selection
        (CVE-2008-3217).
      
    Impact :
    
        A remote attacker could send malicious answers to insert arbitrary DNS
        data into the cache. These attacks would in turn help an attacker to
        perform man-in-the-middle and site impersonation attacks.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200804-22"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All PowerDNS Recursor users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=net-dns/pdns-recursor-3.1.6'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:pdns-recursor");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/04/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/22");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-dns/pdns-recursor", unaffected:make_list("ge 3.1.6"), vulnerable:make_list("lt 3.1.6"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PowerDNS Recursor");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_PDNS-RECURSOR-5319.NASL
    descriptionPdns-recursor was prone to a spoofing vulnerability which could be abused to redirect clients or manipulate data. (CVE-2008-1637)
    last seen2020-06-01
    modified2020-06-02
    plugin id33090
    published2008-06-04
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33090
    titleopenSUSE 10 Security Update : pdns-recursor (pdns-recursor-5319)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update pdns-recursor-5319.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(33090);
      script_version ("1.8");
      script_cvs_date("Date: 2019/10/25 13:36:33");
    
      script_cve_id("CVE-2008-1637");
    
      script_name(english:"openSUSE 10 Security Update : pdns-recursor (pdns-recursor-5319)");
      script_summary(english:"Check for the pdns-recursor-5319 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Pdns-recursor was prone to a spoofing vulnerability which could be
    abused to redirect clients or manipulate data. (CVE-2008-1637)"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected pdns-recursor package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:pdns-recursor");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/05/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/06/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.2|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2 / 10.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.2", reference:"pdns-recursor-3.1.3-22.2") ) flag++;
    if ( rpm_check(release:"SUSE10.3", reference:"pdns-recursor-3.1.4-58.3") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "pdns-recursor");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1544.NASL
    descriptionAmit Klein discovered that pdns-recursor, a caching DNS resolver, uses a weak random number generator to create DNS transaction IDs and UDP source port numbers. As a result, cache poisoning attacks were simplified. (CVE-2008-1637 and CVE-2008-3217 )
    last seen2020-06-01
    modified2020-06-02
    plugin id31950
    published2008-04-17
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/31950
    titleDebian DSA-1544-2 : pdns-recursor - design flaw
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-1544. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31950);
      script_version("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:21");
    
      script_cve_id("CVE-2008-1637", "CVE-2008-3217");
      script_xref(name:"DSA", value:"1544");
    
      script_name(english:"Debian DSA-1544-2 : pdns-recursor - design flaw");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Amit Klein discovered that pdns-recursor, a caching DNS resolver, uses
    a weak random number generator to create DNS transaction IDs and UDP
    source port numbers. As a result, cache poisoning attacks were
    simplified. (CVE-2008-1637 and CVE-2008-3217 )"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-1637"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-3217"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2008/dsa-1544"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the pdns-recursor package.
    
    For the stable distribution (etch), these problems have been fixed in
    version 3.1.4-1+etch2."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:pdns-recursor");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/07/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/17");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"4.0", prefix:"pdns-recursor", reference:"3.1.4-1+etch2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-3010.NASL
    description - Wed Apr 2 2008 Ruben Kerkhof <ruben at rubenkerkhof.com> 3.1.5-1 - Upstream released new version Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id31824
    published2008-04-11
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31824
    titleFedora 7 : pdns-recursor-3.1.5-1.fc7 (2008-3010)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2008-3010.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31824);
      script_version ("1.13");
      script_cvs_date("Date: 2019/08/02 13:32:27");
    
      script_cve_id("CVE-2008-1637");
      script_xref(name:"FEDORA", value:"2008-3010");
    
      script_name(english:"Fedora 7 : pdns-recursor-3.1.5-1.fc7 (2008-3010)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Wed Apr 2 2008 Ruben Kerkhof <ruben at rubenkerkhof.com>
        3.1.5-1
    
        - Upstream released new version
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=440247"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2008-April/009223.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?93cf34fe"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected pdns-recursor package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:pdns-recursor");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:7");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/04/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/11");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 7.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC7", reference:"pdns-recursor-3.1.5-1.fc7")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "pdns-recursor");
    }