CVE-2008-4099 describes a vulnerability in PyDNS (aka python-dns) versions prior to 2.3.1-4 in Debian GNU/Linux. This flaw stems from the software's failure to utilize random source ports or transaction IDs for DNS requests, making it susceptible to DNS response spoofing. The vulnerability carries a CVSS score of 6.4, indicating a medium severity. It is a network-based attack with low attack complexity, requiring no authentication, and could lead to partial integrity and availability impacts. There is no evidence of active exploitation, and no public exploit code is available via Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting low public awareness and attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.3.1-3CPE matchmatch criteria | cpe:2.3:a:debian:python-dns:*:*:*:*:*:*:*:* | ||
2.3.0-1CPE matchmatch criteria | cpe:2.3:a:debian:python-dns:2.3.0-1:*:*:*:*:*:*:* | ||
2.3.0-2CPE matchmatch criteria | cpe:2.3:a:debian:python-dns:2.3.0-2:*:*:*:*:*:*:* | ||
2.3.0-3CPE matchmatch criteria | cpe:2.3:a:debian:python-dns:2.3.0-3:*:*:*:*:*:*:* | ||
2.3.0-4CPE matchmatch criteria | cpe:2.3:a:debian:python-dns:2.3.0-4:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:N/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.