CVE-2007-3153

The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2007-06-11

Last modified

2024-08-07

Affected products

• C-ares (Daniel Stenberg)

References

• http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup
• http://osvdb.org/37172
• http://www.securityfocus.com/bid/24386
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34980