PT-2020-5941 · Treck · Treck Tcp/Ip Stack

Published 2020-06-17 · Updated 2021-07-21 · CVE-2020-11901

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Treck TCP/IP stack versions prior to 6.0.1.66

Description: The issue exists due to insufficient input validation in the Treck TCP/IP stack. It allows a remote attacker to execute arbitrary code using a specially crafted DNS response.

Recommendations: For versions prior to 6.0.1.66, update to version 6.0.1.66 or later to resolve the issue.

Exploit

Fix

Memory Corruption

Out of bounds Read

Use of Insufficiently Random Values

RCE

Weakness Enumeration

CWE-787

CWE-131

CWE-125

CWE-330

CWE-20

Related Identifiers

BDU:2021-02071

CVE-2020-11901

Affected Products

Treck Tcp/Ip Stack

References · 12

• 🔥 https://jsof-tech.com/ripple20 · Exploit
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11901 · Security Note
• https://treck.com · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02071 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11901 · Vendor Advisory
• https://t.me/cvenotify/4426 · Telegram Post
• http://arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt · Note
• https://support.hp.com/us-en/document/c06640149 · Note
• https://dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities · Note
• https://kb.cert.org/vuls/id/257161 · Note
• https://jsof-tech.com/vulnerability-disclosure-policy · Note