The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and…
Priority HIGH 74CWE-331Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Why it matters now
EPSS 0.95182 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix Fixed Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 35
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:* | 6.06 | Running on | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* | 7.04 | Running on | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* | 7.10 | Running on | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:* | 8.04 | Running on | Canonical |
| cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:* | 12.0 | Running on | Cisco |
| cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* | 4.0 | Running on | Debian |
| cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:compute_cluster:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:datacenter:*:itanium:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:* Versions 6.06 Running on ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* Versions 7.04 Running on ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* Versions 7.10 Running on ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:* Versions 8.04 Running on ·Canonical
- cpe:2.3:o:cisco:ios:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Cisco
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Debian
- cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:compute_cluster:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:datacenter:*:itanium:* Versions not specified by NVD Running on ·Microsoft
Show 25 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:enterprise:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:standard:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:storage:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:itanium:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:-:-:*:*:professional:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:* | 2.1 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:* | 2.1 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:* | 2.1 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5:*:client:*:*:*:*:* | 5 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:* | 5 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* | 5.0 | Running on | Red Hat |
| cpe:2.3:a:isc:bind:4:*:*:*:*:*:*:* | 4 | Vulnerable | ISC |
| cpe:2.3:a:isc:bind:8:*:*:*:*:*:*:* | 8 | Vulnerable | ISC |
| cpe:2.3:a:isc:bind:9.2.9:*:*:*:*:*:*:* | 9.2.9 | Vulnerable | ISC |
- cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:enterprise:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:standard:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:storage:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:compute_cluster:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:datacenter:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:enterprise:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:standard:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:itanium:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:storage:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:-:-:*:*:professional:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:* Versions 2.1 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:* Versions 2.1 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:* Versions 2.1 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5:*:client:*:*:*:*:* Versions 5 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:* Versions 5 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
- cpe:2.3:a:isc:bind:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·ISC
- cpe:2.3:a:isc:bind:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·ISC
- cpe:2.3:a:isc:bind:9.2.9:*:*:*:*:*:*:* Versions 9.2.9 Vulnerable ·ISC
Remediation
Red Hat 2 advisories
- RHSA-2008:0789 Released 2008-08-11 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux (v. 5 server) dnsmasq-2.45-1.el5_2.1, dnsmasq-2.45-1.el5_2.1.i386, dnsmasq-2.45-1.el5_2.1.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) dnsmasq-2.45-1.el5_2.1, dnsmasq-2.45-1.el5_2.1.i386
- RHSA-2008:0533 Released 2008-07-08 · Red Hat rating Importantbind security update
- Red Hat Desktop version 3 bind-20:9.2.4-22.el3, bind-20:9.2.4-22.el3.i386, bind-chroot-20:9.2.4-22.el3 +7
- Red Hat Enterprise Linux (v. 5 server) bind-30:9.3.4-6.0.2.P1.el5_2, bind-30:9.3.4-6.0.2.P1.el5_2.i386, bind-30:9.3.4-6.0.2.P1.el5_2.ia64 +34
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1 bind-9.2.1-10.el2, bind-9.2.1-10.el2.i386, bind-9.2.1-10.el2.ia64 +4
- Red Hat Enterprise Linux AS version 3 bind-20:9.2.4-22.el3, bind-20:9.2.4-22.el3.i386, bind-20:9.2.4-22.el3.ia64 +17
- Red Hat Enterprise Linux AS version 4 bind-20:9.2.4-28.0.1.el4, bind-20:9.2.4-28.0.1.el4.i386, bind-20:9.2.4-28.0.1.el4.ia64 +19
- Red Hat Enterprise Linux Desktop (v. 5 client) bind-30:9.3.4-6.0.2.P1.el5_2, bind-30:9.3.4-6.0.2.P1.el5_2.i386, bind-libs-30:9.3.4-6.0.2.P1.el5_2 +10
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) bind-30:9.3.4-6.0.2.P1.el5_2, bind-chroot-30:9.3.4-6.0.2.P1.el5_2, bind-chroot-30:9.3.4-6.0.2.P1.el5_2.i386 +6
- Red Hat Enterprise Linux Desktop version 4 bind-20:9.2.4-28.0.1.el4, bind-20:9.2.4-28.0.1.el4.i386, bind-chroot-20:9.2.4-28.0.1.el4 +9
- Red Hat Enterprise Linux ES version 2.1 bind-9.2.1-10.el2, bind-9.2.1-10.el2.i386, bind-devel-9.2.1-10.el2.i386 +1
- Red Hat Enterprise Linux ES version 3 bind-20:9.2.4-22.el3, bind-20:9.2.4-22.el3.i386, bind-20:9.2.4-22.el3.ia64 +12
- Red Hat Enterprise Linux ES version 4 bind-20:9.2.4-28.0.1.el4, bind-20:9.2.4-28.0.1.el4.i386, bind-20:9.2.4-28.0.1.el4.ia64 +14
- Red Hat Enterprise Linux WS version 2.1 bind-9.2.1-10.el2, bind-9.2.1-10.el2.i386, bind-devel-9.2.1-10.el2.i386 +1
- Red Hat Enterprise Linux WS version 3 bind-20:9.2.4-22.el3, bind-20:9.2.4-22.el3.i386, bind-20:9.2.4-22.el3.ia64 +12
- Red Hat Enterprise Linux WS version 4 bind-20:9.2.4-28.0.1.el4, bind-20:9.2.4-28.0.1.el4.i386, bind-20:9.2.4-28.0.1.el4.ia64 +14
- Red Hat Linux Advanced Workstation 2.1 bind-9.2.1-10.el2, bind-9.2.1-10.el2.ia64, bind-devel-9.2.1-10.el2.ia64 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Desktop version 3 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0533, RHSA-2008:0789 |
| Red Hat Enterprise Linux AS (Advanced Server) version 2.1 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0533, RHSA-2008:0789 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux ES version 2.1 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux WS version 2.1 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2008:0533 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2008:0533 |
| Red Hat Linux Advanced Workstation 2.1 | Fixed | RHSA-2008:0533 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-1447
- 2026-10-03 Alias added: GHSA-r5r9-27m2-2jg7
References
Advisory 106
- FEDORA-2008-6256
- SUSE-SR:2008:017
- VU#800113
- http://www.kb.cert.org/vuls/id/MIMG-7DWR4J
- http://www.phys.uu.nl/~rombouts/pdnsd.html
- GLSA-201209-25
- ADV-2008-2052
- http://www.vmware.com/security/advisories/VMSA-2008-0014.html
- HPSBOV03226
- FreeBSD-SA-08:06
- HPSBMP02404
- [4.2] 013: SECURITY FIX: July 23, 2008
- APPLE-SA-2008-09-15
- ADV-2008-2050
- http://support.citrix.com/article/CTX117991
- http://www.phys.uu.nl/~rombouts/pdnsd/ChangeLog
- APPLE-SA-2008-07-31
- 20080708 Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks
- http://www.nominum.com/asset_upload_file741_2661.pdf
- ADV-2008-2525
- SUSE-SA:2008:033
- IZ26668
- ADV-2008-2025
- 239392
- TA08-260A
- ADV-2008-2029
- SSRT080058
- IZ26671
- FEDORA-2008-6281
- ADV-2008-2268
- ADV-2009-0297
- ADV-2008-2584
- ADV-2008-2051
- RHSA-2008:0789
- ADV-2008-2377
- HPSBNS02405
- RHSA-2008:0533
- [4.3] 004: SECURITY FIX: July 23, 2008
- ADV-2008-2195
- ADV-2008-2196
- HPSBTU02358
- ADV-2008-2384
- IZ26669
- http://up2date.astaro.com/2008/08/up2date_7202_released.html
- ADV-2008-2123
- http://support.apple.com/kb/HT3026
- http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/
- ADV-2008-2482
- IZ26672
- http://support.apple.com/kb/HT3129
- DSA-1619
- ADV-2008-2166
- ADV-2008-2139
- ADV-2008-2092
- IZ26670
- MDVSA-2008:139
- ADV-2008-2055
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=762152
- http://www.ipcop.org/index.php?name=News&file=article&sid=40
- http://www.doxpara.com/?p=1176
- USN-627-1
- ADV-2010-0622
- http://www.isc.org/index.pl?/sw/bind/bind-security.php
- HPSBOV02357
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0231
- ADV-2008-2549
- IZ26667
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU800113.html
- USN-622-1
- http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html
- APPLE-SA-2008-09-12
- http://www.doxpara.com/DMK_BO2K8.ppt
- DSA-1604
- ADV-2008-2558
- http://www.caughq.org/exploits/CAU-EX-2008-0003.txt
- ADV-2008-2383
- http://www.kb.cert.org/vuls/id/MIMG-7ECL8Q
- http://support.citrix.com/article/CTX118183
- ADV-2009-0311
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018
- DSA-1623
- ADV-2008-2582
- http://www.caughq.org/exploits/CAU-EX-2008-0002.txt
- DSA-1605
- http://www.novell.com/support/viewContent.do?externalId=7000912
- http://www.bluecoat.com/support/security-advisories/dns_cache_poisoning
- ADV-2008-2342
- ADV-2008-2114
- GLSA-200812-17
- APPLE-SA-2008-09-09
- ADV-2008-2334
- ADV-2008-2467
- 240048
- TA08-190B
- TA08-190A
- GLSA-200807-08
- SSA:2008-191
- SSA:2008-205-01
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401
- ADV-2008-2030
- ADV-2008-2291
- ADV-2008-2023
- ADV-2008-2466
- ADV-2008-2113
- ADV-2008-2019
- ADV-2008-2197
Other 7
- oval:org.mitre.oval:def:9627
- oval:org.mitre.oval:def:5761
- oval:org.mitre.oval:def:5917
- 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.
- oval:org.mitre.oval:def:5725
- oval:org.mitre.oval:def:12117
- http://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked.html
More ISC Bind vulnerabilities
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
- TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
- TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
- TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
- TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
Sources
- CVE-2008-1447 · CVE Program
- CVE-2008-1447 · NVD
- FIRST EPSS
- GHSA-r5r9-27m2-2jg7 · GitHub Advisory Database · CC BY 4.0
- CVE-2008-1447 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences