CVE-2008-3905

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-09-04 · updated 2026-06-16
Weakness: CWE-287

Description

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

Affected products

Ruby: through 1.8.5; through 1.8.6; through 1.8.7; through 1.9; 1.6, 1.6.8, 1.8.0, 1.8.1, 1.8.2, 1.8.3 (+17)

References

http://secunia.com/advisories/31430
http://secunia.com/advisories/32165
http://secunia.com/advisories/32219
http://secunia.com/advisories/32255
http://secunia.com/advisories/32256
http://secunia.com/advisories/32371
http://secunia.com/advisories/32948
http://secunia.com/advisories/33178
http://security.gentoo.org/glsa/glsa-200812-17.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.371754
http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm
http://www.debian.org/security/2008/dsa-1651

Get alerted when CVE-2008-3905 or the next vulnerability affects your stack