Unrated
djbdns — security advisory
dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.
- Products
- djbdns
- Affected versions
- 1:1.05-15fakesync1, 1:1.05-15ubuntu2, 1:1.05-22ubuntu1, 1:1.05-22ubuntu2, 1:1.05-23fakesync1, 1:1.05-8ubuntu1
- Fixed versions
- Not specified
- CVEs
- CVE-2008-4392
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:19 UTC · Revision 1
Source evidence
dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.
osv:UBUNTU-CVE-2008-4392
djbdns
Fixed versions: Not specified
djbdns
Fixed versions: Not specified
djbdns
Fixed versions: Not specified
djbdns
Fixed versions: Not specified
djbdns
Fixed versions: Not specified
djbdns
Fixed versions: Not specified
Complete source record
{
"id": "31fe975c1754fe60f1f833433d748422e2d80c80490d145f0655ea41a191a1f5",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2008-4392",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2008-4392",
"summary": "dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority (SOA) query.",
"evidence": "osv:UBUNTU-CVE-2008-4392",
"products": [
{
"name": {
"value": "djbdns",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.05-8ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "djbdns",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.05-15fakesync1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "djbdns",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.05-15ubuntu2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "djbdns",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.05-15ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "1:1.05-22ubuntu1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "djbdns",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.05-22ubuntu2",
"evidence": "/affected/4/versions"
},
{
"value": "1:1.05-23fakesync1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "djbdns",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.05-22ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "1:1.05-22ubuntu2",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2008-4392",
"aliases": [
"UBUNTU-CVE-2008-4392"
],
"metrics": [
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "djbdns",
"purl": "pkg:deb/ubuntu/djbdns?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1:1.05-8ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "dbndns",
"binary_version": "1:1.05-8ubuntu1"
},
{
"binary_name": "djbdns",
"binary_version": "1:1.05-8ubuntu1"
},
{
"binary_name": "dnscache-run",
"binary_version": "1:1.05-8ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "djbdns",
"purl": "pkg:deb/ubuntu/djbdns?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1:1.05-15fakesync1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "axfrdns",
"binary_version": "1:1.05-15fakesync1"
},
{
"binary_name": "djbdns-conf",
"binary_version": "1:1.05-15fakesync1"
},
{
"binary_name": "djbdns-utils",
"binary_version": "1:1.05-15fakesync1"
},
{
"binary_name": "dnscache",
"binary_version": "1:1.05-15fakesync1"
},
{
"binary_name": "rbldns",
"binary_version": "1:1.05-15fakesync1"
},
{
"binary_name": "tinydns",
"binary_version": "1:1.05-15fakesync1"
},
{
"binary_name": "walldns",
"binary_version": "1:1.05-15fakesync1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "djbdns",
"purl": "pkg:deb/ubuntu/djbdns?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1:1.05-15ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "axfrdns",
"binary_version": "1:1.05-15ubuntu2"
},
{
"binary_name": "djbdns-conf",
"binary_version": "1:1.05-15ubuntu2"
},
{
"binary_name": "djbdns-utils",
"binary_version": "1:1.05-15ubuntu2"
},
{
"binary_name": "dnscache",
"binary_version": "1:1.05-15ubuntu2"
},
{
"binary_name": "rbldns",
"binary_version": "1:1.05-15ubuntu2"
},
{
"binary_name": "tinydns",
"binary_version": "1:1.05-15ubuntu2"
},
{
"binary_name": "walldns",
"binary_version": "1:1.05-15ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "djbdns",
"purl": "pkg:deb/ubuntu/djbdns?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1:1.05-15ubuntu2",
"1:1.05-22ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "axfrdns",
"binary_version": "1:1.05-22ubuntu1"
},
{
"binary_name": "djbdns-conf",
"binary_version": "1:1.05-22ubuntu1"
},
{
"binary_name": "djbdns-utils",
"binary_version": "1:1.05-22ubuntu1"
},
{
"binary_name": "dnscache",
"binary_version": "1:1.05-22ubuntu1"
},
{
"binary_name": "rbldns",
"binary_version": "1:1.05-22ubuntu1"
},
{
"binary_name": "tinydns",
"binary_version": "1:1.05-22ubuntu1"
},
{
"binary_name": "walldns",
"binary_version": "1:1.05-22ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "djbdns",
"purl": "pkg:deb/ubuntu/djbdns?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1:1.05-22ubuntu2",
"1:1.05-23fakesync1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "axfrdns",
"binary_version": "1:1.05-23fakesync1"
},
{
"binary_name": "djbdns-conf",
"binary_version": "1:1.05-23fakesync1"
},
{
"binary_name": "djbdns-utils",
"binary_version": "1:1.05-23fakesync1"
},
{
"binary_name": "dnscache",
"binary_version": "1:1.05-23fakesync1"
},
{
"binary_name": "rbldns",
"binary_version": "1:1.05-23fakesync1"
},
{
"binary_name": "tinydns",
"binary_version": "1:1.05-23fakesync1"
},
{
"binary_name": "walldns",
"binary_version": "1:1.05-23fakesync1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "djbdns",
"purl": "pkg:deb/ubuntu/djbdns?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1:1.05-22ubuntu1",
"1:1.05-22ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2008/UBUNTU-CVE-2008-4392.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "axfrdns",
"binary_version": "1:1.05-22ubuntu2"
},
{
"binary_name": "djbdns-conf",
"binary_version": "1:1.05-22ubuntu2"
},
{
"binary_name": "djbdns-utils",
"binary_version": "1:1.05-22ubuntu2"
},
{
"binary_name": "dnscache",
"binary_version": "1:1.05-22ubuntu2"
},
{
"binary_name": "rbldns",
"binary_version": "1:1.05-22ubuntu2"
},
{
"binary_name": "tinydns",
"binary_version": "1:1.05-22ubuntu2"
},
{
"binary_name": "walldns",
"binary_version": "1:1.05-22ubuntu2"
}
]
}
}
],
"modified": "2026-10-17T12:52:37.549649609Z",
"provider": "osv",
"upstream": [
"CVE-2008-4392"
],
"references": [
"https://ubuntu.com/security/CVE-2008-4392",
"https://www.cve.org/CVERecord?id=CVE-2008-4392"
]
},
"related_cves": [
{
"value": "CVE-2008-4392",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 353256,
"published_at": "2009-02-19T16:30:00+00:00"
}