CVE-2015-0800

Firefox < 36.0.4 - DNS Spoofing via Predictable PRNG in DNS Resolver

Title source: llm
STIX 2.1

Description

The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031996
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=1110212

Scores

EPSS 0.0046
EPSS Percentile 64.1%

Details

CWE
CWE-200
Status published
Products (1)
mozilla/firefox < 36.0.4
Published Apr 01, 2015
Tracked Since Feb 18, 2026