{"vulnerability": "CVE-2008-1447", "sightings": [{"uuid": "8b4b1e64-4f09-4b57-994a-356a5469f4da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:38.000000Z"}, {"uuid": "854fe9f2-2dd1-48b5-b70a-f381561ba522", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:28.000000Z"}, {"uuid": "ac3dae7a-c4df-4730-b9dd-d42b1eba43ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/spoof/dns/bailiwicked_host.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "de4be61e-9d54-4632-8fa0-2ea75d9042c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/spoof/dns/bailiwicked_domain.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "56767063-35b5-4c8e-8131-1a52e368f430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2008-1447", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/6123", "content": "", "creation_timestamp": "2008-07-24T00:00:00.000000Z"}, {"uuid": "278ed4a2-ae96-4f91-8616-d9e7371d9f55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2008-1447", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/6122", "content": "", "creation_timestamp": "2008-07-23T00:00:00.000000Z"}, {"uuid": "4645d572-a3cf-4d86-b0d1-a99e6505eb7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2008-1447", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/6130", "content": "", "creation_timestamp": "2008-07-25T00:00:00.000000Z"}, {"uuid": "0586631f-0c36-43b1-b142-9e56b2032906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "published-proof-of-concept", "source": "Telegram/DOBfrk2dyhFzkyen0Qpzsdfs3pgTsKY3tpML2V_jo-xel9A", "content": "", "creation_timestamp": "2025-08-22T21:00:04.000000Z"}, {"uuid": "01b35c93-4516-477d-b74f-af19c7bd94d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "https://t.me/VulnerabilityNews/22078", "content": "It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.\nPublished at: May 21, 2021 at 10:15PM\nView on website", "creation_timestamp": "2021-05-22T00:46:52.000000Z"}, {"uuid": "f3164d56-f7ee-4282-996a-62239e23bbc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/spoof/dns/bailiwicked_domain.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"I)ruid \", \"hdm \", \"Cedric Blancher \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This exploit attacks a fairly ubiquitous flaw in DNS implementations which\\n          Dan Kaminsky found and disclosed ~Jul 2008.  This exploit replaces the target\\n          domains nameserver entries in a vulnerable DNS cache server. This attack works\\n          by sending random hostname queries to the target DNS server coupled with spoofed\\n          replies to those queries from the authoritative nameservers for that domain.\\n          Eventually, a guessed ID will match, the spoofed packet will get accepted, and\\n          the nameserver entries for the target domain will be replaced by the server\\n          specified in the NEWDNS option of this exploit.\", \"disclosure_date\": \"2008-07-21\", \"fullname\": \"auxiliary/spoof/dns/bailiwicked_domain\", \"is_install_path\": true, \"mod_time\": \"2026-06-11 10:10:30 +0000\", \"name\": \"DNS BailiWicked Domain Attack\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/auxiliary/spoof/dns/bailiwicked_domain.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"spoof/dns/bailiwicked_domain\", \"references\": [\"CVE-2008-1447\", \"OSVDB-46776\", \"US-CERT-VU-800113\", \"URL-http://web.archive.org/web/20160527135835/http://www.caughq.org/exploits/CAU-EX-2008-0003.txt\"], \"rport\": null, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:14.012461Z"}, {"uuid": "08faf28f-176e-4e3a-9170-cea3688958dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1447", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/spoof/dns/bailiwicked_host.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"I)ruid \", \"hdm \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This exploit attacks a fairly ubiquitous flaw in DNS implementations which\\n          Dan Kaminsky found and disclosed ~Jul 2008.  This exploit caches a single\\n          malicious host entry into the target nameserver by sending random hostname\\n          queries to the target DNS server coupled with spoofed replies to those\\n          queries from the authoritative nameservers for that domain. Eventually, a\\n          guessed ID will match, the spoofed packet will get accepted, and due to the\\n          additional hostname entry being within bailiwick constraints of the original\\n          request the malicious host entry will get cached.\", \"disclosure_date\": \"2008-07-21\", \"fullname\": \"auxiliary/spoof/dns/bailiwicked_host\", \"is_install_path\": true, \"mod_time\": \"2026-06-11 10:10:30 +0000\", \"name\": \"DNS BailiWicked Host Attack\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/auxiliary/spoof/dns/bailiwicked_host.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"spoof/dns/bailiwicked_host\", \"references\": [\"CVE-2008-1447\", \"OSVDB-46776\", \"US-CERT-VU-800113\", \"URL-http://web.archive.org/web/20160606120102/http://www.caughq.org:80/exploits/CAU-EX-2008-0002.txt\"], \"rport\": null, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:14.105649Z"}]}