CVE-2008-1447: The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft...

Security readout for executives and security teams

This is the Kaminsky DNS cache-poisoning flaw. A remote attacker could trick vulnerable recursive DNS resolvers into caching false answers, potentially sending users to attacker-chosen systems instead of the intended domain. The issue affects old DNS resolver implementations and should be treated as important where legacy DNS infrastructure remains in use. Exposure is most likely in legacy recursive DNS resolvers, forwarders, appliances, or embedded systems that retained vulnerable DNS implementations. Modern, patched resolvers are less likely exposed. Inventory should include internal resolvers, branch-office DNS, network appliances, and vendor-managed DNS components. Prioritize remediation where any legacy recursive DNS service remains in production. The business risk is misdirection of users, mail, and application traffic through poisoned DNS responses. For fully patched modern DNS infrastructure, treat this as a legacy assurance and inventory issue. Mitigation focus: Upgrade BIND to vendor-fixed releases or later supported versions.; Apply Microsoft and other vendor DNS security updates where applicable.; Replace unsupported legacy DNS servers and appliances using vulnerable resolver code..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.