An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Link | Tags |
---|---|
https://www.kb.cert.org/vuls/id/815128 | third party advisory us government resource |
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 | third party advisory us government resource |
http://fnet.sourceforge.net/manual/fnet_history.html | third party advisory release notes |