CVE-2008-3905: ruby-lang ruby Improper Authentication

Vulnerability summary

CVE-2008-3905 is a medium (CVSS 5.8) Improper Authentication vulnerability in ruby-lang ruby. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 83.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-09-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.