« Volver al listado

CVE-2007-3153

Estado: ModificadaMedia (5)—

The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Daniel Stenberg — C-ares

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3153",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-06-11T22:30:00.000",
  "references": [
    {
      "url": "http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/37172",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/24386",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34980",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/37172",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/24386",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34980",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values."
    },
    {
      "lang": "es",
      "value": "La función ares_init:randomize_key en c-ares, sobre plataformas diferentes a windows, utiliza una facilidad debil para producir una secuencia de número aleatorio (Unix rand), la cual hace más fácil para el atacante remotos envenenar las respuestas DNS adivinando ciertos valores."
    }
  ],
  "lastModified": "2026-06-16T22:41:10.407",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA7FC9B2-3354-4431-8E6F-3F2752614C04"
            },
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C514051-90BC-448C-ACE3-EA6C9D0D9351"
            },
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77EAA046-EA1B-4EA2-9A20-C1E3355988FD"
            },
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CEE2934-84C0-4EC5-89E4-1B406F1A6BA2"
            },
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50647B2B-3C8B-4862-A246-6FE25FD40018"
            },
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE6851AE-DF26-4ABC-AAE5-BEC8ADBEC7F4"
            },
            {
              "criteria": "cpe:2.3:a:daniel_stenberg:c-ares:1.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A69A0F2-412C-429C-9D75-6EE445DBEA93"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}