PT-2021-3974 · Interniche · Nichestack Tcp/Ip
Published
2021-05-28
·
Updated
2021-08-26
·
CVE-2020-25928
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
InterNiche NicheStack TCP/IP version 4.0.1
Description
The issue is related to errors in processing input data length parameters in the DNS client of InterNiche NicheStack TCP/IP. Exploitation of this issue may allow a remote attacker to execute arbitrary code. The component affected is the DNS response processing functions, including
dns upcall(), getoffset(), and dnc set answer(). The attack vector is a specific DNS response packet. The code does not check the response data length field of individual DNS answers, which may cause out-of-bounds read/write operations, leading to information leak, denial of service, or remote code execution, depending on the context.Recommendations
For InterNiche NicheStack TCP/IP version 4.0.1, consider disabling the DNS response processing functions, specifically
dns upcall(), getoffset(), and dnc set answer(), until a patch is available. Restrict access to the DNS feature to minimize the risk of exploitation. Avoid using the response data length field in individual DNS answers until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Out of bounds Read
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nichestack Tcp/Ip