CVE-2007-3377
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a...
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
Exploit likelihood
What each source reports
NVD Score used
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
- Record
CVE-2007-3377- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
- Record
CVE-2007-3377- Updated
- 2026-11-02
EUVDEUVD-2007-3367 No score
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
- Record
EUVD-2007-3367- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2mqm-w9vq-9c5r No score
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a...
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
- Record
GHSA-2mqm-w9vq-9c5r- Updated
- 2026-11-02
OSV No score
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
- Record
CVE-2007-3377- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3377 No score
Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.
- Record
DEBIAN-CVE-2007-3377- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnet-dns-perlDebian:12 |
before 0.60-1 | 0.60-1 |
libnet-dns-perlDebian:13 |
before 0.60-1 | 0.60-1 |
libnet-dns-perlDebian:14 |
before 0.60-1 | 0.60-1 |
libnet-dns-perlDebian:3.1 From an advisory covering 3 CVEs |
before 0.48-1sarge1, plus listed versions 0.48-1 |
0.48-1sarge1 |
libnet-dns-perlDebian:4.0 From an advisory covering 3 CVEs |
before 0.59-1etch1, plus listed versions 0.59-1 |
0.59-1etch1 |
perl-Net-DNSRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
perl-Net-DNSRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
perl-Net-DNSRed Hat:enterprise_linux:4::as |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:4::as |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNSRed Hat:enterprise_linux:4::desktop |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNSRed Hat:enterprise_linux:4::es |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:4::es |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNSRed Hat:enterprise_linux:4::ws |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:0.48-2.el4 | 0:0.48-2.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3377 is a medium vulnerability (CVSS 4.3) in Nlnet Labs Net Dns, published June 25, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in libnet-dns-perl 0.60-1.
References
secunia.com/advisories/26231
redhat.com/support/errata/RHSA-2007-0675.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9904
Show 39 moreShow less
debian.org/security/2008/dsa-1515
net-dns.org/docs/Changes.html
novell.com/linux/security/advisories/2007_17_sr.html
exchange.xforce.ibmcloud.com/vulnerabilities/35112
support.avaya.com/elmodocs2/security/ASA-2007-351.htm
ubuntu.com/usn/usn-483-1
trustix.org/errata/2007/0023
mandriva.com/security/advisories?name=MDKSA-2007:146
osvdb.org/37053
securitytracker.com/id?1018377
securityfocus.com/bid/24669
rt.cpan.org/Public/Bug/Display.html?id=23961
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245458
gentoo.org/security/en/glsa/glsa-200708-06.xml
nntp.perl.org/group/perl.qpsmtpd/2006/03/msg4810.html
nvd.nist.gov/vuln/detail/CVE-2007-3377
github.com/advisories/GHSA-2mqm-w9vq-9c5r
security-tracker.debian.org/tracker/CVE-2007-3377
access.redhat.com/errata/RHSA-2007:0674
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0674.json
cve.org/CVERecord?id=CVE-2007-3377