Vulnerabilities > CVE-2022-33989 - Insufficient Entropy vulnerability in Dproxy-Nexgen Project Dproxy-Nexgen

047910
CVSS 5.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
LOW
Availability impact
NONE
network
low complexity
dproxy-nexgen-project
CWE-331
NVD
Published: 2022-08-15
Updated: 2022-08-18

Summary

dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.

Vulnerable Configurations

Part Description Count
Application
Dproxy-Nexgen_Project
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

References