Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
uIP和lwIP DNS解析器DNS安全漏洞
Vulnerability Description
uIP和lwIP都是瑞典软件开发者Adam Dunkels所研发的开源TCP/IP协议栈。 lwIP 1.4.1及之前版本的DNS解析器中的dns.c文件和uIP的DNS解析器中的resolv.c文件中存在安全漏洞，该漏洞源于DNS查询数据包的ID字段和源端口没有使用随机数。攻击者可通过伪造的应答数据包利用该漏洞实施中间人攻击和cache-poisoning攻击。
CVSS Information
N/A
Vulnerability Type
N/A