CVE-2020-25928 - The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow

Back Back to CVE browser

CRITICAL

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow

Published Aug 18, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 3.63%

Description

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS response processing functions: dns_upcall(), getoffset(), dnc_set_answer(). The attack vector is: a specific DNS response packet. The code does not check the "response data length" field of individual DNS answers, which may cause out-of-bounds read/write operations, leading to Information leak, Denial-or-Service, or Remote Code Execution, depending on the context.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18558
Advisory
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
x_refsource_MISCMitigationThird Party Advisory
https://www.kb.cert.org/vuls/id/608209
third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18558		Advisory
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/		x_refsource_MISCMitigationThird Party Advisory
https://www.kb.cert.org/vuls/id/608209		third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource