Search for vulnerabilities
| Vulnerability ID | VCID-8fbf-8fea-27d9 |
| Aliases |
CVE-2008-1447
|
| Summary | Two vulnerabilities in dnsmasq might allow for a Denial of Service or spoofing of DNS replies. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.1 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| CWE-331 | Insufficient Entropy |
| System | Score | Found at |
|---|---|---|
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| epss | 0.86697 | https://api.first.org/data/v1/epss?cve=CVE-2008-1447 |
| cvssv2 | 5.0 | https://nvd.nist.gov/vuln/detail/CVE-2008-1447 |
| cvssv3.1 | 6.8 | https://nvd.nist.gov/vuln/detail/CVE-2008-1447 |
| Data source | Exploit-DB |
|---|---|
| Date added | July 23, 2008 |
| Description | BIND 9.x - Remote DNS Cache Poisoning |
| Ransomware campaign use | Known |
| Source publication date | July 24, 2008 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | Sept. 8, 2017 |
| Data source | Metasploit |
|---|---|
| Description | This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed ~Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random hostname queries to the target DNS server coupled with spoofed replies to those queries from the authoritative nameservers for that domain. Eventually, a guessed ID will match, the spoofed packet will get accepted, and due to the additional hostname entry being within bailiwick constraints of the original request the malicious host entry will get cached. |
| Note | Stability: - service-resource-loss SideEffects: - ioc-in-logs Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | July 21, 2008 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/spoof/dns/bailiwicked_host.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Percentile | 0.99417 |
| EPSS Score | 0.86697 |
| Published At | April 1, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-04-01T12:58:38.437469+00:00 | Gentoo Importer | Import | https://security.gentoo.org/glsa/200809-02 | 38.0.0 |