PowerDNS Recursor 3.x < 3.1.6 DNS Predictable Transaction ID (TRXID) Cache Poisoning

medium Nessus Plugin ID 34044


The remote name server is affected by a cache poisoning vulnerability.


According to its self-reported version number, the version of PowerDNS Recursor listening on the remote host is version 3.x prior to 3.1.6.
It is, therefore, affected by a cache poisoning vulnerability due to insufficient randomness to calculate TRXID values and UDP source port numbers. A remote attacker can exploit this poison the DNS cache. This vulnerability was originally fixed in version 3.1.5, but a more secure method was implemented in version 3.1.6.

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Also, Nessus has not checked for the presence of the patch or the workaround.


Upgrade to PowerDNS recursor 3.1.6 or later. Alternatively, apply the patch referenced in the vendor advisory..

See Also



Plugin Details

Severity: Medium

ID: 34044

File Name: pdns_recursor_cache_poisining.nasl

Version: 1.17

Type: remote

Family: DNS

Published: 8/25/2008

Updated: 7/24/2018

Configuration: Enable paranoid mode

Risk Information


Risk Factor: Medium

Score: 6.7


Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:powerdns:powerdns, cpe:/a:powerdns:recursor

Required KB Items: pdns/version_full, pdns/version_source, Settings/ParanoidReport, pdns/version

Exploit Ease: No known exploits are available

Patch Publication Date: 3/31/2008

Vulnerability Publication Date: 3/31/2008

Reference Information

CVE: CVE-2008-1637, CVE-2008-3217

BID: 28517, 30782

CWE: 189