Vulnerability Description
totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Totd Project | Totd | 1.5.3 |
Related Weaknesses (CWE)
References
- https://github.com/fwdillema/totdThird Party Advisory
- https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Kaminsky/BlackHat-JapanThird Party Advisory
- https://www.openwall.com/lists/oss-security/2022/08/14/2ExploitMailing ListThird Party Advisory
- https://www.usenix.org/conference/usenixsecurity22/presentation/jeitnerTechnical DescriptionThird Party Advisory
- https://github.com/fwdillema/totdThird Party Advisory
- https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Kaminsky/BlackHat-JapanThird Party Advisory
- https://www.openwall.com/lists/oss-security/2022/08/14/2ExploitMailing ListThird Party Advisory
- https://www.usenix.org/conference/usenixsecurity22/presentation/jeitnerTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2022-34294?
CVE-2022-34294 is a vulnerability with a CVSS score of 9.8 (CRITICAL). totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.
How severe is CVE-2022-34294?
CVE-2022-34294 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-34294?
Check the references section above for vendor advisories and patch information. Affected products include: Totd Project Totd.