CVE-2020-17467

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.
References
Link Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 Third Party Advisory US Government Resource
http://fnet.sourceforge.net/manual/fnet_history.html Release Notes Third Party Advisory
https://www.kb.cert.org/vuls/id/815128 Third Party Advisory US Government Resource
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:fnet_project:fnet:*:*:*:*:*:*:*:*

Information

Published : 2020-12-11 15:15

Updated : 2020-12-17 18:23


NVD link : CVE-2020-17467

Mitre link : CVE-2020-17467


JSON object : View

CWE
CWE-125

Out-of-bounds Read

Advertisement

dedicated server usa

Products Affected

fnet_project

  • fnet