CVE-2020-17439

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-17439
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17439.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-17439
Published
2020-12-11T23:15:12.857Z
Modified
2026-07-09T00:21:22.187489Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata() in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query with a transaction ID that matches the transaction ID of an incoming reply. Provided that the default DNS cache is quite small (only four records) and that the transaction ID has a very limited set of values that is quite easy to guess, this can lead to DNS cache poisoning.

References

Affected packages

Git / github.com/adamdunkels/uip

Affected ranges

Type
GIT
Repo
https://github.com/adamdunkels/uip
Events
Introduced
a49def743f6e5c7d0c0f2d724f0b8e0c563a4a37
Last affected
a49def743f6e5c7d0c0f2d724f0b8e0c563a4a37
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:uip_project:uip:1.0:*:*:*:*:*:*:*"
}

Affected versions

1.*
1.0
Other
uip-1-0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17439.json"