DNS Resolver Vulnerability in uIP and lwIP Affecting Packet Security
CVE-2014-4883

Currently unrated

Key Information:

Vendor: Lwip Project
Status: Lwip
Vendor: CVE Published:; 28 November 2014

🔔 Create Lwip Project Vulnerability Alert

What is CVE-2014-4883?

The DNS resolver in uIP and lwIP prior to version 1.4.1 suffers from a significant security flaw where it fails to implement randomization for ID fields and source ports in DNS query packets. This weakness exposes the system to potential cache-poisoning attacks, allowing attackers to manipulate DNS responses by sending spoofed packets, thus undermining the integrity of the DNS resolution process.

References

http://www.kb.cert.org/vuls/id/210620

third-party-advisoryx_refsource_CERT-VN

http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=9fb4...

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 28, 2014
Vulnerability Reserved
Jul 10, 2014

CVE-2014-4883 Data

JSON