Description

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

Remediation

References

CVE-2008-3905

Related Vulnerabilities

WordPress 4.1.x Cross-Site Scripting Vulnerability (4.1 - 4.1.8)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Cross-Site Scripting (3.6.7)

Ruby on Rails Missing Encryption of Sensitive Data Vulnerability (CVE-2010-3299)

Payara Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-37422)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3952)

Severity

Medium

Classification

CVE-2008-3905 CWE-287

Tags

Missing Update Known Vulnerabilities