CVE-2008-1447
MEDIUMBIND < 9.5.0-P1, 9.4.2-P1, 9.3.5-P1 - DNS Cache Poisoning via Insufficient Transaction ID and Source Port Entropy
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2008-1447.
PoCs published by Marc Bevand, Julien Desfossez, I)ruid, including Metasploit module auxiliary/spoof/dns/bailiwicked_domain.
AI-analyzed exploit summary This is a functional proof-of-concept exploit for CVE-2008-1447, implementing the Kaminsky DNS cache poisoning attack. It crafts malicious DNS responses to poison a resolver's cache by exploiting predictable transaction IDs and port numbers.
Description
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Exploits (6)
This is a functional proof-of-concept exploit for CVE-2008-1447, implementing the Kaminsky DNS cache poisoning attack. It crafts malicious DNS responses to poison a resolver's cache by exploiting predictable transaction IDs and port numbers.
This exploit leverages the DNS cache poisoning vulnerability (CVE-2008-1447) by brute-forcing transaction IDs to inject a malicious DNS record into a vulnerable DNS server. It uses Scapy to craft and send spoofed DNS responses.
This exploit targets the Kaminsky DNS Cache Poisoning flaw (CVE-2008-1447) by injecting malicious DNS records into a vulnerable DNS resolver. It replaces legitimate nameservers for a target domain with attacker-controlled ones via spoofed DNS responses.
This repository provides a functional Metasploit module for exploiting CVE-2008-1447, a DNS cache poisoning vulnerability, with a fix for a runtime error (`undefined method each` for `IPAddr`). The module replaces target domain nameserver entries in vulnerable DNS servers.
This Metasploit module exploits CVE-2008-1447, a DNS cache poisoning vulnerability, by sending spoofed DNS responses to replace nameserver entries for a target domain. It uses randomized transaction IDs and source ports to bypass DNS server validation.
This Metasploit module exploits CVE-2008-1447, a DNS cache poisoning vulnerability, by sending spoofed DNS responses to inject malicious host entries into a target nameserver's cache. It leverages the bailiwick constraint flaw discovered by Dan Kaminsky.
References (196)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N