CVE-2007-3153 The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to....
MediumCVSS 5.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| daniel stenberg c-ares | = 1.0 | No fix listed |
| daniel stenberg c-ares | = 1.1 | No fix listed |
| daniel stenberg c-ares | = 1.2 | No fix listed |
| daniel stenberg c-ares | = 1.2.1 | No fix listed |
| daniel stenberg c-ares | = 1.3 | No fix listed |
| daniel stenberg c-ares | = 1.3.1 | No fix listed |
| daniel stenberg c-ares | = 1.3.2 | No fix listed |
References
- cool.haxx.se
- 37172 vdb-entry
- 24386 vdb-entry
- cares-aresinitrandomizekey-weak-security(34980) vdb-entry