PT-2020-5598 · Treck · Treck Ipv6

Published 2020-12-18 · Updated 2021-07-21 · CVE-2020-27338

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Treck IPv6 versions prior to 6.0.1.68

Description The issue is related to improper input validation in the DHCPv6 client component, allowing an unauthenticated remote attacker to cause an Out of Bounds Read, and possibly a Denial of Service via adjacent network access. This can be exploited by a remote attacker to disrupt service.

Recommendations For versions prior to 6.0.1.68, update to version 6.0.1.68 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 client component to minimize the risk of exploitation.

Fix

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

BDU:2021-01233

CVE-2020-27338

Affected Products

Treck Ipv6

References · 14

• https://treck.com/vulnerability-response-information · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27338 · Security Note
• https://bdu.fstec.ru/vul/2021-01233 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27338 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-353-01 · Note
• https://t.me/cvenotify/7606 · Telegram Post
• https://ics-cert.kaspersky.ru/news/2021/02/05/getting-back-on-treck-more-vulnerabilities-in-the-infamous-tcp-ip-stack · Note
• https://securitylab.ru/news/515067.php · Note
• https://se.com/ru/ru/download/document/SEVD-2020-353-01 · Note
• https://opennet.ru/opennews/art.shtml?num=53170 · Note
• https://t.me/cvenotify/11993 · Telegram Post
• https://t.me/cvenotify/7596 · Telegram Post
• https://t.me/cibsecurity/21194 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210201-0003 · Note