CVE-2008-1637
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2)...
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
Exploit likelihood
What each source reports
NVD Score used
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
- Record
CVE-2008-1637- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
- Record
CVE-2008-1637- Updated
- 2026-11-02
EUVDEUVD-2008-1638 No score
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
- Record
EUVD-2008-1638- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5qh-3289-h9w4 No score
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2)...
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
- Record
GHSA-c5qh-3289-h9w4- Updated
- 2026-11-02
OSV No score
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
- Record
CVE-2008-1637- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1637 No score
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
- Record
DEBIAN-CVE-2008-1637- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorDebian:12 |
before 3.1.7-1 | 3.1.7-1 |
pdns-recursorDebian:13 |
before 3.1.7-1 | 3.1.7-1 |
pdns-recursorDebian:14 |
before 3.1.7-1 | 3.1.7-1 |
pdns-recursorDebian:4.0 |
before 3.1.4-1+etch1, plus listed versions 3.1.4-1 |
3.1.4-1+etch1 |
pdns-recursorDebian:4.0 From an advisory covering 2 CVEs |
before 3.1.4-1+etch2, plus listed versions 3.1.4-13.1.4-1+etch1 |
3.1.4-1+etch2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1637 is a medium vulnerability (CVSS 6.8) in Powerdns Recursor, published April 2, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.96%, the 90th percentile. Fixed in pdns-recursor 3.1.7-1.
References
secunia.com/advisories/29764
debian.org/security/2008/dsa-1544
redhat.com/archives/fedora-package-announce/2008-April/msg00198.html
securityfocus.com/bid/28517
doc.powerdns.com/changelog.html
Show 15 moreShow less
trusteer.com/docs/powerdnsrecursor.html
lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html
vupen.com/english/advisories/2008/1046/references
exchange.xforce.ibmcloud.com/vulnerabilities/41534
security.gentoo.org/glsa/glsa-200804-22.xml
nvd.nist.gov/vuln/detail/CVE-2008-1637
github.com/advisories/GHSA-c5qh-3289-h9w4
security-tracker.debian.org/tracker/CVE-2008-1637