CWE
330 20
Advisory Published
Updated

CVE-2020-17470: Input Validation

First published: Fri Dec 11 2020(Updated: )

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
<=4.6.4
butok FNET<=4.6.4
Contiki OS
Contiki-NG
uIP
SUSE Open-iSCSI
altran picoTCP-NG
picoTCP
butok FNET
Nut/Net

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2020-17470?

    The severity of CVE-2020-17470 is considered to be high due to its impact on DNS cache poisoning attacks.

  • How do I fix CVE-2020-17470?

    To fix CVE-2020-17470, update FNET to version 4.6.5 or later where the random transaction ID issue has been addressed.

  • What types of software are affected by CVE-2020-17470?

    CVE-2020-17470 affects FNET versions up to 4.6.4 and several other open source networking software including uIP, Contiki, and open-iscsi.

  • What specific issue does CVE-2020-17470 exploit?

    CVE-2020-17470 exploits the lack of randomness in DNS transaction IDs, making it easier for attackers to perform DNS cache poisoning.

  • Is there a known workaround for CVE-2020-17470?

    There are no recommended workarounds for CVE-2020-17470; the best mitigation is to apply the available software update.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203