CVE-2020-24340
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_handle_data_as_answers_generic() in pico_mdns.c does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the packet, leading to an out-of-bounds read, invalid pointer dereference, and Denial-of-Service.
Se detectó un problema en picoTCP y picoTCP-NG versiones hasta 1.7.0. El código que procesa las respuestas DNS en la función pico_mdns_handle_data_as_answers_generic() en el archivo pico_mdns.c no comprueba si el número de respuestas y respuestas especificadas en un encabezado del paquete DNS corresponde a los datos de respuesta disponibles en el paquete, lo que conlleva a una lectura fuera de límites, una desreferencia del puntero no válido y una denegación de servicio
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-08-13 CVE Reserved
- 2020-12-11 CVE Published
- 2023-08-27 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 | Third Party Advisory | |
https://www.kb.cert.org/vuls/id/815128 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Altran Search vendor "Altran" | Picotcp Search vendor "Altran" for product "Picotcp" | <= 1.7.0 Search vendor "Altran" for product "Picotcp" and version " <= 1.7.0" | - |
Affected
| ||||||
Altran Search vendor "Altran" | Picotcp-ng Search vendor "Altran" for product "Picotcp-ng" | <= 1.7.0 Search vendor "Altran" for product "Picotcp-ng" and version " <= 1.7.0" | - |
Affected
|