CVE-2020-17470

Опубликовано: 11 дек. 2020

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.

Ссылки

http://fnet.sourceforge.net/manual/fnet_history.html
Release Notes
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/815128
Third Party Advisory
US Government Resource
http://fnet.sourceforge.net/manual/fnet_history.html
Release Notes
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/815128
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:butok:fnet:*:*:*:*:*:*:*:*

Версия до 4.6.4 (включая)

EPSS

Процентиль: 63%

0.00446

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-330

Связанные уязвимости

GHSA-p7pr-45q9-5m9w