CVE-2020-24339: High severity altran picotcp-ng vulnerability

Q: What is the severity of CVE-2020-24339?

The severity of CVE-2020-24339 is high.

Q: What is the affected software for CVE-2020-24339?

The affected software for CVE-2020-24339 is Altran picoTCP and Altran Picotcp-ng versions up to and including 1.7.0.

Q: How does CVE-2020-24339 impact the DNS domain name record decompression functionality?

CVE-2020-24339 does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing a vulnerability.

Q: Is there a fix available for CVE-2020-24339?

It is recommended to update to picoTCP and picoTCP-NG versions above 1.7.0 to fix CVE-2020-24339.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2020-24339?

The CWE ID for CVE-2020-24339 is CWE-125.

Published Dec 11, 2020

Updated

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname() in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds reads that lead to Denial-of-Service.

Affected Software

10 affected components

Altran picoTCP<=1.7.0

Altran Picotcp-ng<=1.7.0

Multiple (open source) uIP-Contiki-OS (end-of-life [EOL]), Version 3.0 and prior

Multiple (open source) uIP-Contiki-NG, Version 4.5 and prior

Multiple (open source) uIP (EOL), Version 1.0 and prior

Multiple (open source) open-iscsi, Version 2.1.12 and prior

Multiple (open source) picoTCP-NG, Version 1.7.0 and prior

Multiple (open source) picoTCP (EOL), Version 1.7.0 and prior

Multiple (open source) FNET, Version 4.6.3

Multiple (open source) Nut/Net, Version 5.1 and prior

Event History

Dec 11, 2020

CVE Published

via MITRE·10:53 PM

Data Sourced

via MITRE·10:53 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-343-01

Frequently Asked Questions

What is the severity of CVE-2020-24339?

The severity of CVE-2020-24339 is high.

What is the affected software for CVE-2020-24339?

The affected software for CVE-2020-24339 is Altran picoTCP and Altran Picotcp-ng versions up to and including 1.7.0.

How does CVE-2020-24339 impact the DNS domain name record decompression functionality?

CVE-2020-24339 does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing a vulnerability.

Is there a fix available for CVE-2020-24339?