CVE-2007-2926

NameCVE-2007-2926
DescriptionISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1341-2

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)bullseye1:9.16.50-1~deb11u2fixed
bullseye (security)1:9.16.50-1~deb11u1fixed
bookworm, bookworm (security)1:9.18.28-1~deb12u2fixed
sid, trixie1:9.20.4-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bind9sourcesarge1:9.2.4-1sarge3DSA-1341-2
bind9sourceetch1:9.3.4-2etch1DSA-1341-2
bind9source(unstable)1:9.4.1-P1-1
Search for package or bug name: Reporting problems