Critical WID-SEC-2022-1044 33 CVEs

TCP/IP Stack: Mehrere Schwachstellen

Published Dec 8, 2020 · Updated Jul 27, 2023 · Revision 8 · de-DE

Vendor: SUSE Vendor: Ubuntu Vendor: Unify Product: Linux Product: Linux Product: OpenScape 4000 Product: OpenScape Alarm Response Product: OpenScape Business Product: OpenScape Common Management Platform Product: OpenScape Cordless IP Product: OpenScape Desk Phone Product: OpenScape Xpert

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TCP/IP Stack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, einen Denial of Service Angriff durchzuführen, vertrauliche Daten einzusehen oder Daten zu manipulieren.

Product

Der TCP/IP-Stack bzw. die Internet Protocol Suite ist eine Reihe von Kommunikationsprotokollen, die vom Internet oder ähnlichen Netzwerken verwendet werden.

Vulnerabilities 33

Unscored —

CVE-2020-13984

An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when processi…

Dec 11, 2020
Unscored —

CVE-2020-13985

An issue was discovered in Contiki through 3.0. A memory corruption vulnerability exists in the uIP TCP/IP stack compon…

Dec 11, 2020
Unscored —

CVE-2020-13986

An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when handling…

Dec 11, 2020
Unscored —

CVE-2020-13987

An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack comp…

open-iscsi open-iscsi Debian Ubuntu

Dec 11, 2020
Unscored —

CVE-2020-13988

An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsi…

open-iscsi open-iscsi Debian Ubuntu

Dec 11, 2020
Unscored —

CVE-2020-17437

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP pac…

open-iscsi open-iscsi Debian Ubuntu

Dec 11, 2020
Unscored —

CVE-2020-17438 EPSS 19%

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented pac…

Dec 11, 2020
Unscored —

CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packet…

Dec 11, 2020
Unscored —

CVE-2020-17440

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packet…

Dec 11, 2020
Unscored —

CVE-2020-17441

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 headers does not validate whether the IPv6 p…

Dec 11, 2020
Unscored —

CVE-2020-17442

An issue was discovered in picoTCP 1.7.0. The code for parsing the hop-by-hop IPv6 extension headers does not validate …

Dec 11, 2020
Unscored —

CVE-2020-17443

An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6…

Dec 11, 2020
Unscored —

CVE-2020-17444

An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IP…

Dec 11, 2020
Unscored —

CVE-2020-17445

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 destination options does not check for a val…

Dec 11, 2020
Unscored —

CVE-2020-17467

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check…

Dec 11, 2020
Unscored —

CVE-2020-17468

An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension hea…

Dec 11, 2020
Unscored —

CVE-2020-17469

An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragmen…

Dec 11, 2020
Unscored —

CVE-2020-17470

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not se…

Dec 11, 2020
Unscored —

CVE-2020-24334

The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the…

Dec 11, 2020
Unscored —

CVE-2020-24335

An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks,…

Feb 2, 2021
Unscored —

CVE-2020-24336 EPSS 59%

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answ…

Dec 11, 2020
Unscored —

CVE-2020-24337

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is pro…

Dec 11, 2020
Unscored —

CVE-2020-24338 EPSS 37%

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_de…

Dec 11, 2020
Unscored —

CVE-2020-24339

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality…

Dec 11, 2020
Unscored —

CVE-2020-24340

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_han…

Dec 11, 2020
Unscored —

CVE-2020-24341

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c d…

Dec 11, 2020
Unscored —

CVE-2020-24383

An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check f…

Dec 11, 2020
Unscored —

CVE-2020-25107 EPSS 54%

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. There is no check on whether a domain name…

Dec 11, 2020
Unscored —

CVE-2020-25108 EPSS 54%

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The DNS response data length is not checke…

Dec 11, 2020
Unscored —

CVE-2020-25109 EPSS 54%

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The number of DNS queries/responses (set i…

Dec 11, 2020
Unscored —

CVE-2020-25110 EPSS 54%

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The length byte of a domain name in a DNS …

Dec 11, 2020
Unscored —

CVE-2020-25111 EPSS 21%

An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header le…

Dec 11, 2020
Unscored —

CVE-2020-25112 EPSS 28%

An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extensi…

Dec 11, 2020

Revision history

2023-07-27 #8
Neue Updates von Ubuntu aufgenommen
2022-08-22 #7
Neue Updates von SUSE aufgenommen
2022-08-15 #6
Neue Updates von SUSE aufgenommen
2021-04-13 #5
Neue Updates von SUSE aufgenommen
2021-03-01 #4
Neue Updates von SUSE aufgenommen
2021-01-10 #3
Neue Updates von Unify aufgenommen
2020-12-14 #2
Schreibfehler korrigiert
2020-12-08 #1
Initiale Fassung

References

Ubuntu Security Notice USN-6259-1 vom 2023-07-27
https://ubuntu.com/security/notices/USN-6259-1
SUSE Security Update SUSE-SU-2021:1164-1 vom 2021-04-13
https://lists.suse.com/pipermail/sle-security-updates/2021-April/008619.html
US ICS CERT Advisory ICSA-20-343-01 vom 2020-12-08
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
Pressemeldung des BSI vom 2020-12-08
https://www.bsi.bund.de/DE/Presse/Kurzmeldungen/Meldungen/Amnesia_201208.html
Unify Security Advisory Report OBSO-2101-01 vom 2021-01-08
https://networks.unify.com/security/advisories/OBSO-2101-01.pdf
SUSE Security Update SUSE-SU-2021:0663-1 vom 2021-03-01
https://lists.suse.com/pipermail/sle-security-updates/2021-March/008407.html
SUSE Security Update SUSE-SU-2022:2806-1 vom 2022-08-15
https://lists.suse.com/pipermail/sle-security-updates/2022-August/011912.html
SUSE Security Update SUSE-SU-2022:2861-1 vom 2022-08-22
https://lists.suse.com/pipermail/sle-security-updates/2022-August/011958.html