Description
An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.
Advisories 2
- WID-SEC-2022-1044 TCP/IP Stack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 27, 2023
- ICSA-20-343-01 Multiple Embedded TCP/IP Stacks CISA ICS & IT advisories · Dec 8, 2020