CVE-2020-17440

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products

published December 11, 2020

CVSS
—
EPSS
3%
Percentile
86.3
In the wild
Unconfirmed
What it is

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain name bytes in DNS response packets when a name lacks this termination, and eventually leads to dereferencing the pointer at an invalid/arbitrary address, within newdata() and parse_name() in resolv.c.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02794 · 86.3th percentile
Published
2020-12-11T22:27Z
EPSS history
Timeline
  • 11 DEC 22:27Z
    An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products
    cvelistv5