CVE-2020-17467
An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-17467?
CVE-2020-17467 is classified as a medium severity vulnerability due to its potential for Information Disclosure.
How do I fix CVE-2020-17467?
To mitigate CVE-2020-17467, ensure to update affected software to the latest version that addresses the hostname processing issue.
Which software versions are affected by CVE-2020-17467?
CVE-2020-17467 affects FNET versions up to 4.6.4 and various versions of open-source products including uIP, Contiki-OS, and open-iscsi.
What type of vulnerability is CVE-2020-17467?
CVE-2020-17467 is an Information Disclosure vulnerability related to improper hostname processing.
Can I safely use affected versions of software with CVE-2020-17467?
Using affected versions of software with CVE-2020-17467 poses a risk of exposing sensitive information, so upgrading is recommended.