{"id":"UBUNTU-CVE-2008-4392","details":"dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.","modified":"2026-05-20T16:03:04.013095522Z","published":"2009-02-19T16:30:00Z","upstream":["CVE-2008-4392"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2008-4392"},{"type":"REPORT","url":"http://cr.yp.to/djbdns/forgery.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2008-4392"}],"affected":[{"package":{"name":"djbdns","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/djbdns?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.05-8ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"dbndns","binary_version":"1:1.05-8ubuntu1"},{"binary_version":"1:1.05-8ubuntu1","binary_name":"djbdns"},{"binary_name":"dnscache-run","binary_version":"1:1.05-8ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"}},{"package":{"name":"djbdns","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/djbdns?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.05-15fakesync1"],"ecosystem_specific":{"binaries":[{"binary_version":"1:1.05-15fakesync1","binary_name":"axfrdns"},{"binary_name":"djbdns-conf","binary_version":"1:1.05-15fakesync1"},{"binary_name":"djbdns-utils","binary_version":"1:1.05-15fakesync1"},{"binary_version":"1:1.05-15fakesync1","binary_name":"dnscache"},{"binary_name":"rbldns","binary_version":"1:1.05-15fakesync1"},{"binary_name":"tinydns","binary_version":"1:1.05-15fakesync1"},{"binary_name":"walldns","binary_version":"1:1.05-15fakesync1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"}},{"package":{"name":"djbdns","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/djbdns?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.05-15ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"axfrdns","binary_version":"1:1.05-15ubuntu2"},{"binary_version":"1:1.05-15ubuntu2","binary_name":"djbdns-conf"},{"binary_version":"1:1.05-15ubuntu2","binary_name":"djbdns-utils"},{"binary_name":"dnscache","binary_version":"1:1.05-15ubuntu2"},{"binary_name":"rbldns","binary_version":"1:1.05-15ubuntu2"},{"binary_version":"1:1.05-15ubuntu2","binary_name":"tinydns"},{"binary_name":"walldns","binary_version":"1:1.05-15ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"}},{"package":{"name":"djbdns","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/djbdns?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.05-15ubuntu2","1:1.05-22ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"axfrdns","binary_version":"1:1.05-22ubuntu1"},{"binary_name":"djbdns-conf","binary_version":"1:1.05-22ubuntu1"},{"binary_name":"djbdns-utils","binary_version":"1:1.05-22ubuntu1"},{"binary_name":"dnscache","binary_version":"1:1.05-22ubuntu1"},{"binary_name":"rbldns","binary_version":"1:1.05-22ubuntu1"},{"binary_version":"1:1.05-22ubuntu1","binary_name":"tinydns"},{"binary_name":"walldns","binary_version":"1:1.05-22ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"}},{"package":{"name":"djbdns","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/djbdns?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.05-22ubuntu1","1:1.05-22ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"axfrdns","binary_version":"1:1.05-22ubuntu2"},{"binary_version":"1:1.05-22ubuntu2","binary_name":"djbdns-conf"},{"binary_version":"1:1.05-22ubuntu2","binary_name":"djbdns-utils"},{"binary_name":"dnscache","binary_version":"1:1.05-22ubuntu2"},{"binary_name":"rbldns","binary_version":"1:1.05-22ubuntu2"},{"binary_name":"tinydns","binary_version":"1:1.05-22ubuntu2"},{"binary_name":"walldns","binary_version":"1:1.05-22ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"}}],"schema_version":"1.7.5","severity":[{"type":"Ubuntu","score":"medium"}]}