CVE-2020-17470: Input Validation
An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-17470?
The severity of CVE-2020-17470 is considered to be high due to its impact on DNS cache poisoning attacks.
How do I fix CVE-2020-17470?
To fix CVE-2020-17470, update FNET to version 4.6.5 or later where the random transaction ID issue has been addressed.
What types of software are affected by CVE-2020-17470?
CVE-2020-17470 affects FNET versions up to 4.6.4 and several other open source networking software including uIP, Contiki, and open-iscsi.
What specific issue does CVE-2020-17470 exploit?
CVE-2020-17470 exploits the lack of randomness in DNS transaction IDs, making it easier for attackers to perform DNS cache poisoning.
Is there a known workaround for CVE-2020-17470?
There are no recommended workarounds for CVE-2020-17470; the best mitigation is to apply the available software update.