CVE-2020-24335
First published: Tue Feb 02 2021(Updated: )
An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Uip Project Uip | <=1.0 | |
| Contiki-ng Contiki-ng | ||
| Contiki-os Contiki | ||
| Multiple (open source) picoTCP-NG, Version 1.7.0 and prior | ||
| Multiple (open source) picoTCP (EOL), Version 1.7.0 and prior | ||
| Multiple (open source) FNET, Version 4.6.3 | ||
| Multiple (open source) Nut/Net, Version 5.1 and prior |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2020-24335.
What is the affected software?
The affected software is uIP through version 1.0, as used in Contiki and Contiki-NG.
What is the severity of CVE-2020-24335?
The severity of CVE-2020-24335 is high with a CVSS score of 7.5.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending crafted DNS packets to the affected system.
Are there any patches or fixes available for this vulnerability?
Patch information for CVE-2020-24335 can be found in the references provided.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/uip project
- canonical/uip project uip
- version/uip project uip/1.0
- vendor/contiki-ng
- canonical/contiki-ng contiki-ng
- vendor/contiki-os
- canonical/contiki-os contiki
- vendor/multiple (open source)
- canonical/multiple (open source) picotcp-ng, version 1.7.0 and prior
- canonical/multiple (open source) picotcp (eol), version 1.7.0 and prior
- canonical/multiple (open source) fnet, version 4.6.3
- canonical/multiple (open source) nut/net, version 5.1 and prior