CVE-2020-25927

CVE-2020-25927 targets InterNiche/NicheStack TCP/IP (pre-4.3). The DNS response processing path dns_upcall() does not validate the DNS header’s query/response counts against the packet data, causing an out-of-bounds read and potential remote DoS. The ICS/CISA advisory Update B lists this issue am...

CVE-2020-25927

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service remote. The component is: DNS response processing in function: dnsupcall. The attack vector is: a specific DNS response packet. The code does not check whether the number o...

CVE-2020-25926

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning remote. The component is: dnsquerytype. The attack vector is: a specific DNS response packet...

CVE-2020-25926

Summary of CVE-2020-25926 (INFRA:HALT) in HCC Embedded/NicheStack: The DNS client in InterNiche NicheStack TCP/IP (pre-4.3) suffers from insufficient entropy in DNS transaction IDs, enabling remote DNS cache poisoning via specially crafted responses. The related ICS/National advisories enumerate ...

CVE-2020-25927: Out-of-bounds Read

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service remote. The component is: DNS response processing in function: dnsupcall. The attack vector is: a specific DNS response packet. The code does not check whether the number o...

CVE-2020-25928: Out-of-bounds Read

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code remote. The component is: DNS response processing functions: dnsupcall, getoffset, dncsetanswer. The attack vector is: a specific DNS response packet. The code does not che...

CVE-2020-25926: Insufficient Entropy

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning remote. The component is: dnsquerytype. The attack vector is: a specific DNS response packet...

HCC Embedded InterNiche 输入验证错误漏洞

InterNiche Technologies NicheStack is a small footprint, RFC-compliant embedded stack that is portable to commercial or proprietary non-MMU operating systems. InterNiche Technologies NicheStack suffers from an input validation error vulnerability that exists due to insufficient validation of...

PT-2021-3862

Name of the Vulnerable Software and Affected Versions InterNiche NicheStack TCP/IP version 4.0.1 Description The DNS client in InterNiche NicheStack TCP/IP is affected by insufficient entropy in the DNS transaction id, which can lead to DNS cache poisoning. The component dns query type is involve...

PT-2021-3980

Name of the Vulnerable Software and Affected Versions InterNiche NicheStack versions 4.0.1 and earlier Description The web server in InterNiche NicheStack allows remote attackers to cause a denial of service, resulting in an infinite loop and networking outage, via an unexpected valid HTTP reques...

PT-2021-3974

Name of the Vulnerable Software and Affected Versions InterNiche NicheStack TCP/IP version 4.0.1 Description The issue is related to errors in processing input data length parameters in the DNS client of InterNiche NicheStack TCP/IP. Exploitation of this issue may allow a remote attacker to execu...