An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet (e.g., forward compression pointer jumps are allowed), which leads to an Out-of-bounds Read, and a Denial-of-Service as a consequence.
References
| Link | Resource |
|---|---|
| https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ | Mitigation Third Party Advisory |
| https://www.kb.cert.org/vuls/id/608209 | Third Party Advisory US Government Resource |
| https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ | Mitigation Third Party Advisory |
| https://www.kb.cert.org/vuls/id/608209 | Third Party Advisory US Government Resource |
Configurations
History
21 Nov 2024, 05:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - Mitigation, Third Party Advisory | |
| References | () https://www.kb.cert.org/vuls/id/608209 - Third Party Advisory, US Government Resource |
26 Aug 2021, 19:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:hcc-embedded:nichestack_ipv4:4.1:*:*:*:*:*:*:* | |
| CWE | CWE-125 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (MISC) https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - Mitigation, Third Party Advisory | |
| References | (CERT-VN) https://www.kb.cert.org/vuls/id/608209 - Third Party Advisory, US Government Resource |
18 Aug 2021, 19:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-18 19:15
Updated : 2024-11-21 05:18
NVD link : CVE-2020-25767
Mitre link : CVE-2020-25767
CVE.ORG link : CVE-2020-25767
JSON object : View
Products Affected
hcc-embedded
- nichestack_ipv4
CWE
CWE-125
Out-of-bounds Read