dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.
References
| Link | Resource |
|---|---|
| https://sourceforge.net/projects/dproxy/ | Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2022/08/14/3 | Exploit Mailing List Third Party Advisory |
| https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner | Third Party Advisory |
Configurations
History
18 Aug 2022, 16:53
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | CWE-331 | |
| CPE | cpe:2.3:a:dproxy-nexgen_project:dproxy-nexgen:-:*:*:*:*:*:*:* | |
| References | (MISC) https://sourceforge.net/projects/dproxy/ - Third Party Advisory | |
| References | (MISC) https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - Third Party Advisory | |
| References | (MISC) https://www.openwall.com/lists/oss-security/2022/08/14/3 - Exploit, Mailing List, Third Party Advisory |
15 Aug 2022, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-15 13:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-33989
Mitre link : CVE-2022-33989
CVE.ORG link : CVE-2022-33989
JSON object : View
Products Affected
dproxy-nexgen_project
- dproxy-nexgen
CWE
CWE-331
Insufficient Entropy