PT-2020-14988 · Contiki · Contiki+1

Published 2020-12-11 · Updated 2020-12-15 · CVE-2020-17439

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions uIP version 1.0 Contiki version 3.0

Description The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata() in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query with a transaction ID that matches the transaction ID of an incoming reply. Provided that the default DNS cache is quite small (only four records) and that the transaction ID has a very limited set of values that is quite easy to guess, this can lead to DNS cache poisoning.

Recommendations For uIP version 1.0, consider disabling the newdata() function in resolv.c to prevent arbitrary DNS replies from being parsed until a patch is available. For Contiki version 3.0, restrict access to the DNS cache to minimize the risk of exploitation. Avoid using the transaction ID in the affected DNS queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-17439

Affected Products

Contiki

Uip

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-17439 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17439 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Note
• https://t.me/cibsecurity/20701 · Telegram Post
• https://t.me/cibsecurity/20661 · Telegram Post
• https://t.me/cvenotify/7054 · Telegram Post
• https://kb.cert.org/vuls/id/815128 · Note
• https://t.me/cibsecurity/20720 · Telegram Post
• https://t.me/cibsecurity/20681 · Telegram Post