CVE-2020-17467
First published: Fri Dec 11 2020(Updated: )
An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| butok FNET | <=4.6.4 | |
| Contiki OS | ||
| Contiki-NG | ||
| uIP | ||
| SUSE Open-iSCSI | ||
| altran picoTCP-NG | ||
| picoTCP | ||
| butok FNET | ||
| Nut/Net |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-17467?
CVE-2020-17467 is classified as a medium severity vulnerability due to its potential for Information Disclosure.
How do I fix CVE-2020-17467?
To mitigate CVE-2020-17467, ensure to update affected software to the latest version that addresses the hostname processing issue.
Which software versions are affected by CVE-2020-17467?
CVE-2020-17467 affects FNET versions up to 4.6.4 and various versions of open-source products including uIP, Contiki-OS, and open-iscsi.
What type of vulnerability is CVE-2020-17467?
CVE-2020-17467 is an Information Disclosure vulnerability related to improper hostname processing.
Can I safely use affected versions of software with CVE-2020-17467?
Using affected versions of software with CVE-2020-17467 poses a risk of exposing sensitive information, so upgrading is recommended.
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/author
- agent/softwarecombine
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/butok
- canonical/butok fnet
- version/butok fnet/4.6.4
- vendor/multiple (open source)
- canonical/contiki os
- canonical/contiki-ng
- canonical/uip
- canonical/suse open-iscsi
- canonical/altran picotcp-ng
- canonical/picotcp
- canonical/nut/net