CVE-2020-17467
Summary
| CVE | CVE-2020-17467 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-12-11 23:15:00 UTC |
| Updated | 2023-10-12 18:31:00 UTC |
| Description | An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN. |
Risk And Classification
Problem Types: CWE-125
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Butok | Fnet | All | All | All | All |
| Application | Fnet Project | Fnet | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| VU#815128 - Embedded TCP/IP stacks have memory corruption vulnerabilities | MISC | www.kb.cert.org | Third Party Advisory, US Government Resource |
| fnet.sourceforge.net/manual/fnet_history.html | CONFIRM | fnet.sourceforge.net | Release Notes, Third Party Advisory |
| Multiple Embedded TCP/IP Stacks | CISA | MISC | us-cert.cisa.gov | Third Party Advisory, US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.