CVE-2007-2188 eXtremail 2.1.1 and earlier does not verify the ID field (aka transaction id) in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing.
HighCVSS 10.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
eXtremail 2.1.1 and earlier does not verify the ID field (aka transaction id) in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| extremail | = 2.1 | No fix listed |
| extremail | = 2.1.1 | No fix listed |
References
- 20070420 eXtremail-v9 exploit mailing-list
- 35584 vdb-entry
- 23577 vdb-entry