CoreCVE
Back

MEDIUM

resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets

Published Nov 28, 2014

Description

resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-345

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner certcc
Published Nov 28, 2014
Updated Aug 6, 2024
Reserved Jul 10, 2014
Link CVE-2014-4883
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-4883
Red Hat
Severity n/a
Public date n/a
Links CVE-2014-4883