CVE-2007-3377

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-06-25 · updated 2026-06-16

Description

Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.

Affected products

NLnet Labs Net Dns: 0.14, 0.20, 0.21, 0.22, 0.23, 0.24 (+58)

References

http://osvdb.org/37053
http://rt.cpan.org/Public/Bug/Display.html?id=23961
http://secunia.com/advisories/25829
http://secunia.com/advisories/26012
http://secunia.com/advisories/26014
http://secunia.com/advisories/26055
http://secunia.com/advisories/26075
http://secunia.com/advisories/26211
http://secunia.com/advisories/26231
http://secunia.com/advisories/26417
http://secunia.com/advisories/26508

Get alerted when CVE-2007-3377 or the next vulnerability affects your stack