DNS Cache Poisoning

DNS responses are matched only by transaction ID (16-bit). An attacker who can forge a response with the correct txid before the real one arrives can inject a malicious record into the resolver's cache.