CVE-2014-4883 resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for....
MediumCVSS 4.3
EPSS 0.57%
- Published
- Updated
- Exploit status
- No public exploit known
Description
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lwip project lwip | <= 1.4.1 | No fix listed |
| ubuntu/lwipv6(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/lwipv6(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/lwipv6(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/lwipv6(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- git.savannah.gnu.org patch
- VU#210620 third-party-advisory us-government-resource
- Debian Security Tracker CVE-2014-4883 vendor-advisory