CVE-2020-24335: High severity uip vulnerability
Published Feb 2, 2021
·Updated
An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
Affected Software
11 affected components
Uip Project Uip<=1.0
Contiki-NG Contiki-NG
Contiki-os Contiki
Multiple (open source) uIP-Contiki-OS (end-of-life [EOL]), Version 3.0 and prior
Multiple (open source) uIP-Contiki-NG, Version 4.5 and prior
Multiple (open source) uIP (EOL), Version 1.0 and prior
Multiple (open source) open-iscsi, Version 2.1.12 and prior
Multiple (open source) picoTCP-NG, Version 1.7.0 and prior
Multiple (open source) picoTCP (EOL), Version 1.7.0 and prior
Multiple (open source) FNET, Version 4.6.3
Multiple (open source) Nut/Net, Version 5.1 and prior
Event History
Feb 2, 2021
CVE Published
via MITRE·06:13 AM
Data Sourced
via MITRE·06:13 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2020-24335.
2
What is the affected software?
The affected software is uIP through version 1.0, as used in Contiki and Contiki-NG.
3
What is the severity of CVE-2020-24335?
The severity of CVE-2020-24335 is high with a CVSS score of 7.5.
4
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending crafted DNS packets to the affected system.
5
Are there any patches or fixes available for this vulnerability?
Patch information for CVE-2020-24335 can be found in the references provided.