667 matches found
Code injection
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafti...
Default configuration
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...
Remote code execution
An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...
Design/Logic Flaw
An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...
CVE-2020-25112
The CVE-2020-25112 entry corresponds to a memory-corruption vulnerability in Contiki’s uIP-Contiki-OS IPv6 stack. The issue arises from insufficient and inconsistent checks of IPv6 header extension lengths, enabling crafted ICMPv6 or other IPv6-extension-based packets to trigger memory corruption...
CVE-2020-25112
An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...
CVE-2020-25111
CVE-2020-25111 affects Contiki’s IPv6 stack (up to v3.0); root cause is insufficient IPv6 header length validation, enabling Denial-of-Service and potential Remote Code Execution via crafted ICMPv6 echo packets. Exploitation is network-based; affected code paths involve IPv6 header/extension hand...
CVE-2020-25111
An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...
CVE-2020-24336
CVE-2020-24336 affects Contiki (through v3.0) and Contiki-NG (through v4.5). The issue is in ip64-dns64.c DNS64 Type A domain-name parsing, where the code does not verify that the address length is sane. Copying an address of arbitrary length can cause a buffer overflow when NAT64 is enabled. Con...
CVE-2020-24336
An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. Thi...
CVE-2020-24334
The CVE-2020-24334 issue affects the DNS response handling in uIP (used by Contiki/Contiki-NG). It allows an out-of-bounds read in resolv.c when the DNS header’s answer count does not match the actual data present, enabling Denial-of-Service. Affected stacks include uIP up to 1.0 and Contiki/Cont...
CVE-2020-24334
The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses specified in the DNS packet header corresponds to the response data available in the DNS packet, leading to an out-of-bounds read and Denial-of-Service in...
CVE-2020-17440
CVE-2020-17440 affects uIP 1.0 (and Contiki-OS/NG and related stacks) where DNS packet parsing does not verify that domain names are null-terminated, enabling memory corruption via crafted DNS responses. Root cause is improper null termination handling in resolv.c (newdata()/parse_name()). Impact...
CVE-2020-17440
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain...
CVE-2020-17439
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query wi...
CVE-2020-17439
CVE-2020-17439 affects uIP 1.0 (used in Contiki 3.0 and other products). The DNS client parses DNS replies without validating that replies match outgoing queries; DNS transaction IDs are insufficiently random and small DNS caches (4 entries) enable DNS cache poisoning. Connected sources confirm a...
CVE-2020-17438
CVE-2020-17438 affects uIP 1.0 (used in Contiki 3.0 and other products). The IP reassembly code fails to validate the total packet length and fragmentation offset, enabling crafted IP headers to write past the static buffer into the .bss area, causing a denial of service in uip_reass() and potent...
CVE-2020-17437
CVE-2020-17437 affects uIP 1.0 (used in Contiki 3.0 and similar) where the TCP Urgent flag and Urgent pointer are not properly bounded. When urgent data is ignored, code uses the Urgent pointer as an offset to separate urgent data, but the offset length isn’t checked, allowing the data pointer to...
CVE-2020-17437
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by...
