exploits , vulnerabilities , articles , OpenBSD PRNG DNS Cache Poisoning and Predictable IP ID Weakness

Title	OpenBSD PRNG DNS Cache Poisoning and Predictable IP ID Weakness
Published	2008-02-06-12:00AM
Updated	2008-03-13-10:21PM
Class	Design Error
CVE
Remote	Yes
Local	No
Credit	Amit Klein discovered this vulnerability.
Vulnerable	OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 4.2 OpenBSD OpenBSD 4.1 OpenBSD OpenBSD 4.0 OpenBSD OpenBSD 3.9 OpenBSD OpenBSD 3.8 OpenBSD OpenBSD 3.7 OpenBSD OpenBSD 3.6 OpenBSD OpenBSD 3.5 OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 NetBSD NetBSD 3.0.2 NetBSD NetBSD 3.0.1 NetBSD NetBSD 2.1 NetBSD NetBSD 2.0.3 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD 1.6.2 NetBSD NetBSD 4.0 BETA2 NetBSD NetBSD 4.0 NetBSD NetBSD 4,0_Beta NetBSD NetBSD 3.1_RC3 NetBSD NetBSD 3.1 NetBSD NetBSD 3.1 NetBSD NetBSD 3,1_RC1 NetBSD NetBSD 2.1.1 NetBSD NetBSD 2.0.4 Navision Financials Server 3.0 FreeBSD FreeBSD 6.0 .x FreeBSD FreeBSD 6.0 STABLE FreeBSD FreeBSD 6.0 RELEASE FreeBSD FreeBSD 5.5 STABLE FreeBSD FreeBSD 5.5 RELEASE FreeBSD FreeBSD 5.4 RELENG FreeBSD FreeBSD 5.4 RELEASE FreeBSD FreeBSD 5.4 PRERELEASE FreeBSD FreeBSD 5.3 STABLE FreeBSD FreeBSD 5.3 RELENG FreeBSD FreeBSD 5.3 RELEASE FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 5.2.1 RELEASE FreeBSD FreeBSD 5.2 RELENG FreeBSD FreeBSD 5.2 RELEASE FreeBSD FreeBSD 5.2 FreeBSD FreeBSD 5.1 RELENG FreeBSD FreeBSD 5.1 RELEASE/Alpha FreeBSD FreeBSD 5.1 RELEASEp5 FreeBSD FreeBSD 5.1 RELEASE FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 5.0 .x FreeBSD FreeBSD 5.0 RELENG FreeBSD FreeBSD 5.0 RELEASEp14 FreeBSD FreeBSD 5.0 alpha FreeBSD FreeBSD 5.0 FreeBSD FreeBSD 4.11 STABLE FreeBSD FreeBSD 4.11 RELENG FreeBSD FreeBSD 4.11 RELEASEp3 FreeBSD FreeBSD 4.11 RELEASEp20 FreeBSD FreeBSD 4.11 RELEASE FreeBSD FreeBSD 4.10 RELENG FreeBSD FreeBSD 4.10 RELEASEp8 FreeBSD FreeBSD 4.10 RELEASE FreeBSD FreeBSD 4.10 FreeBSD FreeBSD 4.9 RELENG FreeBSD FreeBSD 4.9 PRERELEASE FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 RELENG FreeBSD FreeBSD 4.8 RELEASEp7 FreeBSD FreeBSD 4.8 PRERELEASE FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.7 STABLE FreeBSD FreeBSD 4.7 RELENG FreeBSD FreeBSD 4.7 RELEASEp17 FreeBSD FreeBSD 4.7 RELEASE FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6.2 FreeBSD FreeBSD 4.6 STABLE FreeBSD FreeBSD 4.6 RELENG FreeBSD FreeBSD 4.6 RELEASEp20 FreeBSD FreeBSD 4.6 RELEASE FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 STABLEpre20020307 FreeBSD FreeBSD 4.5 STABLE FreeBSD FreeBSD 4.5 RELENG FreeBSD FreeBSD 4.5 RELEASEp32 FreeBSD FreeBSD 4.5 RELEASE FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 STABLE FreeBSD FreeBSD 4.4 RELENG FreeBSD FreeBSD 4.4 RELENG FreeBSD FreeBSD 4.4 RELEASEp42 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 7.0 BETA4 FreeBSD FreeBSD 7.0 RELENG FreeBSD FreeBSD 7.0 PRERELEASE FreeBSD FreeBSD 6.3 RELENG FreeBSD FreeBSD 6.3 FreeBSD FreeBSD 6.2 STABLE FreeBSD FreeBSD 6.2 RELENG FreeBSD FreeBSD 6.2 FreeBSD FreeBSD 6.1 STABLE FreeBSD FreeBSD 6.1 RELEASEp10 FreeBSD FreeBSD 6.1 RELEASE FreeBSD FreeBSD 6.0 RELEASEp5 FreeBSD FreeBSD 5.4STABLE FreeBSD FreeBSD 4.10PRERELEASE DragonFlyBSD DragonFlyBSD 1.10.1 DragonFlyBSD DragonFlyBSD 1.2 DragonFlyBSD DragonFlyBSD 1.1 DragonFlyBSD DragonFlyBSD 1.0 Darwin Darwin 9.1 Darwin Darwin 1.0 Cosmicperl Directory Pro 10.0.3 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 Apple Mac OS X 10.5
Not Vulnerable	OpenBSD OpenBSD 4.3
Code	Proof-of-concept exploit code is available in the referenced PDF document by Amit Klein.
TXT

Vulnerabilities - newest 10 RSS | More

2008-10-10 CUPS Multiple Heap Based Buffer Overflow Vulnerabilities
2008-10-10 Sun Java System Web Proxy Server FTP Subsytem Heap Based Buffer Overflow Vulnerability
2008-10-09 ModSecurity Transformation Caching Security Bypass Vulnerability
2008-10-09 DATAC RealWin SCADA Server Remote Stack Buffer Overflow Vulnerability
2008-10-09 Avaya Communication Manager Web Administration Multiple Security Vulnerabilities
2008-10-09 HP System Management Homepage (SMH) for Linux and Windows Cross Site Scripting Vulnerability
2008-10-09 YaCy Multiple Unspecified Vulnerabilities
2008-10-09 Opera Cached Java Applet Security Bypass Vulnerability
2008-10-09 WOW Raid Manager Unspecified Cross Site Scripting Vulnerability
2008-10-09 Drupal EveryBlog Module Multiple Unspecified Vulnerabilities