Treck TCP/IP-Stack: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 19

• Medium 5.4
  CVE-2020-11899 Exploited EPSS 18%

  The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

  Jun 17, 2020

  KEV Mar 3, 2022
• Critical 9.8
  CVE-2020-11910 EPSS 11%

  The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.

  Jun 17, 2020
• Critical 9.1
  CVE-2020-11909

  The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.

  Jun 17, 2020
• Unscored —
  CVE-2020-11896 Public exploit EPSS 37%

  The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

  Jun 17, 2020
• Unscored —
  CVE-2020-11897

  The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.

  Jun 17, 2020
• Unscored —
  CVE-2020-11898 Public exploit EPSS 19%

  The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might al…

  Jun 17, 2020
• Unscored —
  CVE-2020-11900 EPSS 13%

  The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.

  Jun 17, 2020
• Unscored —
  CVE-2020-11901 EPSS 22%

  The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

  Jun 17, 2020
• Unscored —
  CVE-2020-11902

  The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.

  Jun 17, 2020
• Unscored —
  CVE-2020-11903

  The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.

  Jun 17, 2020
• Unscored —
  CVE-2020-11904

  The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Wr…

  Jun 17, 2020
• Unscored —
  CVE-2020-11905

  The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.

  Jun 17, 2020
• Unscored —
  CVE-2020-11906

  The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.

  Jun 17, 2020
• Unscored —
  CVE-2020-11907

  The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.

  Jun 17, 2020
• Unscored —
  CVE-2020-11908

  The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.

  Jun 17, 2020
• Unscored —
  CVE-2020-11911

  The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.

  Jun 17, 2020
• Unscored —
  CVE-2020-11912

  The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.

  Jun 17, 2020
• Unscored —
  CVE-2020-11913

  The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

  Jun 17, 2020
• Unscored —
  CVE-2020-11914

  The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.

  Jun 17, 2020

Revision history

1. 2023-03-19 #12

   Neue Updates von EATON aufgenommen

2. 2021-03-25 #11

   Neue Updates von HP aufgenommen

3. 2021-02-23 #10

   Neue Updates von DELL aufgenommen

4. 2020-10-07 #9

   Neue Updates von HPE aufgenommen

5. 2020-08-17 #8

   Neue Updates von HPE aufgenommen

6. 2020-07-14 #7

   Neue Updates von HPE aufgenommen

7. 2020-07-08 #6

   Neue Informationen von Palo Alto Networks aufgenommen

8. 2020-06-24 #5

   Neue Updates von EMC aufgenommen

9. 2020-06-23 #4

   Neue Updates aufgenommen

10. 2020-06-21 #3

    Neue Updates von EMC aufgenommen

11. 2020-06-17 #2

    Neue Updates von Cisco aufgenommen

12. 2020-06-16 #1

    Initiale Fassung

References

• EATON Security Bulletin ETN-SB-2020-1008 vom 2023-03-17
  https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/ETN-SB-2020-1008.pdf
• HPE Security Bulletins
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04103en_us
• Report auf Jsof-Tech.com vom 2020-06-16
  https://www.jsof-tech.com/ripple20/
• Intel Security Advisory:INTEL-SA-00295 vom 2020-06-16
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html
• HP Security Bulletin HPSBPI03666 rev. 1 vom 2020-06-16
  https://support.hp.com/emea_africa-en/document/c06640149
• Schneider Electric Security Bulletin SESB-2020-168-01 vom 2020-06-16
  https://www.se.com/ww/en/download/document/SESB-2020-168-01/
• ICS-Advisorys des Departments of Homeland Security vom 2020-06-16
  https://www.us-cert.gov/ics/advisories/icsa-20-168-01
• KB-Cert Vulnerability Note VU#257161 vom 2020-06-16
  https://www.kb.cert.org/vuls/id/257161
• Xerox Security Bulletin XRX20J vom 2020-06-16
  https://security.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20J_for_B2XX.pdf
• Cisco Security Advisory CISCO-SA-TRECK-IP-STACK-JYBQ5GYC vom 2020-06-17
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC
• EMC Security Advisory SLN321836 vom 2020-06-22
  https://www.dell.com/support/article/sln321836/dell-response-to-the-ripple20-vulnerabilities?lang=en
• Aruba Product Security Advisory
  https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt
• EMC Security Advisory DSA-2020-150 vom 2020-06-25
  https://www.dell.com/support/article/sln321835/dsa-2020-150-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards?lang=en
• Palo Alto Networks Security Advisory PAN-SA-2020-0007 vom 2020-07-08
  https://security.paloaltonetworks.com/PAN-SA-2020-0007
• HPE SECURITY BULLETIN HPESBHF04012 rev.1 vom 2020-07-13
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us
• HPE SECURITY BULLETIN HPESBHF04012 rev.2 vom 2020-08-14
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us
• HPE Security Bulletin hpesbhf04021en_us vom 2020-10-06
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04021en_us
• EMC Security Advisory DSA-2020-206 vom 2021-02-24
  https://www.dell.com/support/kbdoc/de-de/000125440/dsa-2020-206-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards