CVE-2008-3217

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-07-18 · updated 2026-06-16
Weakness: CWE-189

Description

PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning. NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637.

Affected products

PowerDNS Recursor: through 3.1.5; 3.0, 3.0.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4

References

http://doc.powerdns.com/changelog.html#CHANGELOG-RECURSOR-3-1-6
http://secunia.com/advisories/31311
http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/1179
http://www.openwall.com/lists/oss-security/2008/07/09/10
http://www.openwall.com/lists/oss-security/2008/07/10/6
http://www.openwall.com/lists/oss-security/2008/07/16/12
http://www.securityfocus.com/bid/30782
https://exchange.xforce.ibmcloud.com/vulnerabilities/43925
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01353.html
http://doc.powerdns.com/changelog.html#CHANGELOG-RECURSOR-3-1-6
http://secunia.com/advisories/31311
http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/1179

Get alerted when CVE-2008-3217 or the next vulnerability affects your stack