FKIE_CVE-2020-17437

Vulnerability from fkie_nvd - Published: 2020-12-11 23:15 - Updated: 2024-11-21 05:08
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Summary
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.
References
cve@mitre.orghttps://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdfPatch, Third Party Advisory
cve@mitre.orghttps://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
cve@mitre.orghttps://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdfPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
uip_project uip *
contiki-os contiki *
open-iscsi_project open-iscsi *
siemens sentron_3va_com100_firmware *
siemens sentron_3va_com100 -
siemens sentron_3va_com800_firmware *
siemens sentron_3va_com800 -
siemens sentron_3va_dsp800_firmware *
siemens sentron_3va_dsp800 -
siemens sentron_pac2200_clp_firmware -
siemens sentron_pac2200_clp -
siemens sentron_pac2200_firmware *
siemens sentron_pac2200 -
siemens sentron_pac3200_firmware *
siemens sentron_pac3200 -
siemens sentron_pac3200t_firmware *
siemens sentron_pac3200t -
siemens sentron_pac3220_firmware *
siemens sentron_pac3220 -
siemens sentron_pac4200_firmware *
siemens sentron_pac4200 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:uip_project:uip:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "98518C5F-7D0A-4B03-A062-651E613A01BE",
              "versionEndIncluding": "1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:contiki-os:contiki:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBD2BE71-F851-4136-816D-EF61154FD2C4",
              "versionEndIncluding": "3.0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:open-iscsi_project:open-iscsi:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81144F12-C2BC-4789-A010-E437BD1C2833",
              "versionEndIncluding": "2.1.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_3va_com100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "507AAF60-4AFE-4D80-A698-13BD5818CAE7",
              "versionEndExcluding": "4.4.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_3va_com100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C308EF6-7893-44EF-978E-9019B0060911",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_3va_com800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08B3AAE7-AAC6-4ECC-9338-AC8841336C59",
              "versionEndExcluding": "4.4.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_3va_com800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CECE258-D12A-4483-AF4B-A63FAD08A767",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_3va_dsp800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2433BD7C-53EC-421E-A64F-B21F2C6A971E",
              "versionEndExcluding": "4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_3va_dsp800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FA1D28-4B29-4318-B377-737A7F1CDF77",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_pac2200_clp_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "21817081-5AE8-4097-B835-BBDE1E7FC798",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_pac2200_clp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "19DDE73C-D684-4987-B124-DD10E185459D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_pac2200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A45625A-B498-4805-9B69-50099B7C96D2",
              "versionEndExcluding": "3.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_pac2200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D86E3742-4BCD-4425-B7C8-5C0311AEBDCE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_pac3200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "92EDAF30-8EC2-4C76-BD27-6C6084B9CA03",
              "versionEndExcluding": "2.4.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_pac3200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "624451C4-149D-4FEE-B2FB-020574F03231",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_pac3200t_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA4C0536-25FF-4A46-99D3-C40063EB5F93",
              "versionEndExcluding": "3.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_pac3200t:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "11CE5687-8EEA-407F-BCE4-D1E6301F910C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_pac3220_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E106502-8480-496D-90BC-D2B5EADFC91C",
              "versionEndExcluding": "3.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_pac3220:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "342EBD90-D831-4D99-97CA-13B8399EAD53",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:sentron_pac4200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E46CC95C-7941-4B23-A0E9-79AB18A6E9C2",
              "versionEndExcluding": "2.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:sentron_pac4200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B48B5DE2-25BF-44A1-BB12-A734DD4A9560",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en uIP versi\u00f3n 1.0, como es usado en Contiki versi\u00f3n 3.0 y otros productos.\u0026#xa0;Cuando el flag Urgent es ajustado en un paquete TCP, y la pila est\u00e1 configurada para ignorar los datos urgentes, la pila intenta usar el valor de los bytes del puntero Urgent para separar los datos Urgent de los datos normales, al calcular el desplazamiento en el que los datos normales deben estar presentes en el b\u00fafer global.\u0026#xa0;Sin embargo, no se comprueba la longitud de este desplazamiento;\u0026#xa0;por lo tanto, para valores grandes de bytes de puntero Urgent, el puntero de datos puede apuntar a la memoria que est\u00e1 mucho m\u00e1s all\u00e1 del b\u00fafer de datos en la funci\u00f3n uip_process en el archivo uip.c"
    }
  ],
  "id": "CVE-2020-17437",
  "lastModified": "2024-11-21T05:08:06.540",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-12-11T23:15:12.683",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/815128"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/815128"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.