PT-2020-15011 · Fnet · Fnet

Published 2020-12-11 · Updated 2023-10-12 · CVE-2020-17469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FNET versions through 4.6.4

Description An issue in the IPv6 fragment reassembly code causes an uninitialized pointer dereference in the fnet ip6 reassembly function in fnet ip6.c, leading to a Denial-of-Service. This occurs when the code tries to access a previous fragment from a network incoming fragment that does not have a reference to the previous one, and there are empty holes between the fragments in a non-empty fragment list.

Recommendations For FNET versions through 4.6.4, as a temporary workaround, consider disabling the IPv6 fragment reassembly functionality until a patch is available. Restrict access to the fnet ip6 reassembly function in fnet ip6.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2020-17469

Affected Products

Fnet

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-17469 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17469 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Note
• https://t.me/cvenotify/7253 · Telegram Post
• https://t.me/cibsecurity/20658 · Telegram Post
• https://t.me/cvenotify/7069 · Telegram Post
• https://kb.cert.org/vuls/id/815128 · Note
• https://t.me/cibsecurity/20698 · Telegram Post
• http://fnet.sourceforge.net/manual/fnet_history.html · Note
• https://t.me/cibsecurity/20717 · Telegram Post
• https://t.me/cibsecurity/20678 · Telegram Post