Re: DNS Cache Poisoning vulnerability (CVE-2008-1447, VU#800113)

On Mon, 14 Jul 2008, Josh Carroll wrote:

> My understanding was that this particular CERT was due to a predictable
> source port. So the TXID being random is good, but the source port being
> non-random (or pseudo-random) is the problem.

Right, but c-ares isn't setting the source port to anything AFAIK so it uses
the random port provided by the OS. I believe the problems in some other
implementations was because they explictily set the source port number.

-- 
  / daniel.haxx.se