CVE-2020-17440

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-17440
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17440.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-17440
Published
2020-12-11T23:15:13.153Z
Modified
2026-07-09T00:21:21.268838Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain name bytes in DNS response packets when a name lacks this termination, and eventually leads to dereferencing the pointer at an invalid/arbitrary address, within newdata() and parse_name() in resolv.c.

References

Affected packages

Git / github.com/adamdunkels/uip

Affected ranges

Type
GIT
Repo
https://github.com/adamdunkels/uip
Events
Introduced
a49def743f6e5c7d0c0f2d724f0b8e0c563a4a37
Last affected
a49def743f6e5c7d0c0f2d724f0b8e0c563a4a37
Database specific 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:uip_project:uip:1.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        }
    ]
}

Affected versions

1.*
1.0
Other
uip-1-0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17440.json"