PT-2020-15721 · Fnet · Fnet

Published 2020-12-11 · Updated 2023-10-12 · CVE-2020-24383

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions FNET versions through 4.6.4

Description An issue was discovered in the code for processing resource records in mDNS queries, which doesn't check for proper '0' termination of the resource record name string, leading to an out-of-bounds read, and potentially causing information leak or Denial-of-Service.

Recommendations For versions through 4.6.4, as a temporary workaround, consider restricting the use of mDNS queries until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-24383

Affected Products

Fnet

References · 10

• https://osv.dev/vulnerability/CVE-2020-24383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24383 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Note
• https://t.me/cibsecurity/20682 · Telegram Post
• https://t.me/cibsecurity/20721 · Telegram Post
• https://t.me/cvenotify/7070 · Telegram Post
• https://kb.cert.org/vuls/id/815128 · Note
• https://t.me/cibsecurity/20702 · Telegram Post
• https://t.me/cvenotify/7092 · Telegram Post
• https://t.me/cibsecurity/20662 · Telegram Post