CVE-2008-3905: Medium severity ruby vulnerability
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3905?
CVE-2008-3905 has been classified as a medium severity vulnerability due to its potential to allow remote DNS response spoofing.
How do I fix CVE-2008-3905?
To fix CVE-2008-3905, upgrade to Ruby version 1.8.6-p287, 1.8.7-p72, or any later version.
Which versions of Ruby are affected by CVE-2008-3905?
CVE-2008-3905 affects Ruby 1.8.5 and earlier, Ruby 1.8.6 before 1.8.6-p287, Ruby 1.8.7 before 1.8.7-p72, and Ruby 1.9 r18423 and earlier.
What type of attack does CVE-2008-3905 facilitate?
CVE-2008-3905 makes it easier for attackers to spoof DNS responses, potentially allowing them to redirect users to malicious sites.
Is CVE-2008-3905 related to any other vulnerabilities?
CVE-2008-3905 is a different vulnerability than CVE-2008-1447, which addresses a separate issue within the Ruby DNS resolver.