PT-2021-11027 · Contiki+2 · Contiki+2

Published 2021-02-02 · Updated 2021-02-05 · CVE-2020-24335

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: uIP versions through 1.0 Contiki (affected versions not specified) Contiki-NG (affected versions not specified)

Description: An issue was discovered in the domain name parsing functionality, which lacks bounds checks. This allows an attacker to corrupt memory by sending crafted DNS packets.

Recommendations: For uIP versions through 1.0, consider implementing bounds checks in the domain name parsing function to prevent memory corruption. For Contiki, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Contiki-NG, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2020-24335

Affected Products

Contiki

Contiki-Ng

Uip

References · 9

• https://osv.dev/vulnerability/CVE-2020-24335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24335 · Security Note
• https://github.com/contiki-os/contiki · Note
• https://github.com/contiki-ng/contiki-ng · Note
• https://github.com/adamdunkels/uip · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 · Note
• https://t.me/cvenotify/9236 · Telegram Post
• https://kb.cert.org/vuls/id/815128 · Note
• https://t.me/cvenotify/9449 · Telegram Post