Unscored severity · published Jul 18, 2008
CVE-2008-3217
PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS…
–
CVSS
1.8%
EPSS
No
On KEV
Description
PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning. NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Recursor · Powerdns
through 3.1.5; 3.0; 3.0.1; 3.1.1; 3.1.2; 3.1.3; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3217
doc.powerdns.com
http://doc.powerdns.com/changelog.html#CHANGELOG-RECURSOR-3-1-6
secunia.com
http://secunia.com/advisories/31311
Patch
http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/1179
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/07/09/10
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/07/10/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/07/16/12
More from Recursor
9.8
CVE-2019-3807
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not…
8.8
CVE-2020-10030
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0
8.2
CVE-2025-59023
Crafted delegations or IP fragments can poison cached delegations in Recursor
8.1
CVE-2019-3806
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination…
7.5
CVE-2026-52688
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation