var-202012-0245
Vulnerability from variot
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c. Multiple open-source embedded TCP/IP stacks, commonly used in Internet of Things (IoT) and embedded devices, have several vulnerabilities stemming from improper memory management. These vulnerabilities are also tracked as ICS-VU-633937 and JVNVU#96491057 as well as the name AMNESIA:33.CVE-2020-13984 Not Affected CVE-2020-13985 Affected CVE-2020-13986 Affected CVE-2020-13987 Affected CVE-2020-13988 Affected CVE-2020-17437 Affected CVE-2020-17438 Affected CVE-2020-17439 Affected CVE-2020-17440 Affected CVE-2020-17441 Not Affected CVE-2020-17442 Not Affected CVE-2020-17443 Not Affected CVE-2020-17444 Not Affected CVE-2020-17445 Not Affected CVE-2020-17467 Not Affected CVE-2020-17468 Not Affected CVE-2020-17469 Not Affected CVE-2020-17470 Not Affected CVE-2020-24334 Affected CVE-2020-24335 Not Affected CVE-2020-24336 Affected CVE-2020-24337 Not Affected CVE-2020-24338 Not Affected CVE-2020-24339 Not Affected CVE-2020-24340 Not Affected CVE-2020-24341 Not Affected CVE-2020-24383 Not Affected CVE-2020-25107 Not Affected CVE-2020-25108 Not Affected CVE-2020-25109 Not Affected CVE-2020-25110 Not Affected CVE-2020-25111 Not Affected CVE-2020-25112 Not Affected CVE-2021-28362 Not AffectedCVE-2020-13984 Not Affected CVE-2020-13985 Affected CVE-2020-13986 Affected CVE-2020-13987 Affected CVE-2020-13988 Affected CVE-2020-17437 Affected CVE-2020-17438 Affected CVE-2020-17439 Affected CVE-2020-17440 Affected CVE-2020-17441 Not Affected CVE-2020-17442 Not Affected CVE-2020-17443 Not Affected CVE-2020-17444 Not Affected CVE-2020-17445 Not Affected CVE-2020-17467 Not Affected CVE-2020-17468 Not Affected CVE-2020-17469 Not Affected CVE-2020-17470 Not Affected CVE-2020-24334 Affected CVE-2020-24335 Not Affected CVE-2020-24336 Affected CVE-2020-24337 Not Affected CVE-2020-24338 Not Affected CVE-2020-24339 Not Affected CVE-2020-24340 Not Affected CVE-2020-24341 Not Affected CVE-2020-24383 Not Affected CVE-2020-25107 Not Affected CVE-2020-25108 Not Affected CVE-2020-25109 Not Affected CVE-2020-25110 Not Affected CVE-2020-25111 Not Affected CVE-2020-25112 Not Affected CVE-2021-28362 Not Affected. Multiple Embedded TCP/IP is an efficient embedded stack developed using a verifiable process and strictly compliant with MISRA coding standards. ========================================================================= Ubuntu Security Notice USN-6259-1 July 27, 2023
open-iscsi vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Open-iSCSI.
Software Description: - open-iscsi: Open Source iSCSI implementation
Details:
Jos Wetzels, Stanislav Dashevskyi, and Amine Amri discovered that Open-iSCSI incorrectly handled certain checksums for IP packets. An attacker could possibly use this issue to expose sensitive information. (CVE-2020-13987)
Jos Wetzels, Stanislav Dashevskyi, Amine Amri discovered that Open-iSCSI incorrectly handled certain parsing TCP MSS options. An attacker could possibly use this issue to cause a crash or cause unexpected behavior. (CVE-2020-13988)
Amine Amri and Stanislav Dashevskyi discovered that Open-iSCSI incorrectly handled certain TCP data. An attacker could possibly use this issue to expose sensitive information. (CVE-2020-17437)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04 LTS: open-iscsi 2.0.874-7.1ubuntu6.4
Ubuntu 18.04 LTS (Available with Ubuntu Pro): open-iscsi 2.0.874-5ubuntu2.11+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro): open-iscsi 2.0.873+git0.3b4b4500-14ubuntu3.7+esm1
In general, a standard system update will make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-6259-1 CVE-2020-13987, CVE-2020-13988, CVE-2020-17437
Package Information: https://launchpad.net/ubuntu/+source/open-iscsi/2.0.874-7.1ubuntu6.4
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202012-0245",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "uip",
"scope": "lte",
"trust": 1.0,
"vendor": "uip",
"version": "1.0"
},
{
"model": "sentron pac3220",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.0"
},
{
"model": "sentron pac2200",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.2"
},
{
"model": "sentron pac4200",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2.3.0"
},
{
"model": "sentron pac3200",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "2.4.7"
},
{
"model": "sentron pac3200t",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.2"
},
{
"model": "sentron 3va com800",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.4.1"
},
{
"model": "open-iscsi",
"scope": "lte",
"trust": 1.0,
"vendor": "open iscsi",
"version": "2.1.7"
},
{
"model": "sentron pac2200 clp",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": null
},
{
"model": "sentron 3va dsp800",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.0"
},
{
"model": "sentron 3va com100",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.4.1"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-17437"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:uip_project:uip:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:contiki-os:contiki:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.0",
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:open-iscsi_project:open-iscsi:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.1.7",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_3va_com100_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.4.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_3va_com100:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_3va_com800_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.4.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_3va_com800:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_3va_dsp800_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_3va_dsp800:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_pac2200_clp_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_pac2200_clp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_pac2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_pac2200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_pac3200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.4.7",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_pac3200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_pac3200t_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_pac3200t:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_pac3220_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_pac3220:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sentron_pac4200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.3.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sentron_pac4200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-17437"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "This document was written by Vijay Sarvepalli.Statement Date:\u00a0\u00a0 December 08, 2020",
"sources": [
{
"db": "CERT/CC",
"id": "VU#815128"
}
],
"trust": 0.8
},
"cve": "CVE-2020-17437",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2020-17437",
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-17437",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202012-664",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2020-17437",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c. Multiple open-source embedded TCP/IP stacks, commonly used in Internet of Things (IoT) and embedded devices, have several vulnerabilities stemming from improper memory management. These vulnerabilities are also tracked as ICS-VU-633937 and JVNVU#96491057 as well as the name AMNESIA:33.CVE-2020-13984 Not Affected\nCVE-2020-13985 Affected\nCVE-2020-13986 Affected\nCVE-2020-13987 Affected\nCVE-2020-13988 Affected\nCVE-2020-17437 Affected\nCVE-2020-17438 Affected\nCVE-2020-17439 Affected\nCVE-2020-17440 Affected\nCVE-2020-17441 Not Affected\nCVE-2020-17442 Not Affected\nCVE-2020-17443 Not Affected\nCVE-2020-17444 Not Affected\nCVE-2020-17445 Not Affected\nCVE-2020-17467 Not Affected\nCVE-2020-17468 Not Affected\nCVE-2020-17469 Not Affected\nCVE-2020-17470 Not Affected\nCVE-2020-24334 Affected\nCVE-2020-24335 Not Affected\nCVE-2020-24336 Affected\nCVE-2020-24337 Not Affected\nCVE-2020-24338 Not Affected\nCVE-2020-24339 Not Affected\nCVE-2020-24340 Not Affected\nCVE-2020-24341 Not Affected\nCVE-2020-24383 Not Affected\nCVE-2020-25107 Not Affected\nCVE-2020-25108 Not Affected\nCVE-2020-25109 Not Affected\nCVE-2020-25110 Not Affected\nCVE-2020-25111 Not Affected\nCVE-2020-25112 Not Affected\nCVE-2021-28362 Not AffectedCVE-2020-13984 Not Affected\nCVE-2020-13985 Affected\nCVE-2020-13986 Affected\nCVE-2020-13987 Affected\nCVE-2020-13988 Affected\nCVE-2020-17437 Affected\nCVE-2020-17438 Affected\nCVE-2020-17439 Affected\nCVE-2020-17440 Affected\nCVE-2020-17441 Not Affected\nCVE-2020-17442 Not Affected\nCVE-2020-17443 Not Affected\nCVE-2020-17444 Not Affected\nCVE-2020-17445 Not Affected\nCVE-2020-17467 Not Affected\nCVE-2020-17468 Not Affected\nCVE-2020-17469 Not Affected\nCVE-2020-17470 Not Affected\nCVE-2020-24334 Affected\nCVE-2020-24335 Not Affected\nCVE-2020-24336 Affected\nCVE-2020-24337 Not Affected\nCVE-2020-24338 Not Affected\nCVE-2020-24339 Not Affected\nCVE-2020-24340 Not Affected\nCVE-2020-24341 Not Affected\nCVE-2020-24383 Not Affected\nCVE-2020-25107 Not Affected\nCVE-2020-25108 Not Affected\nCVE-2020-25109 Not Affected\nCVE-2020-25110 Not Affected\nCVE-2020-25111 Not Affected\nCVE-2020-25112 Not Affected\nCVE-2021-28362 Not Affected. Multiple Embedded TCP/IP is an efficient embedded stack developed using a verifiable process and strictly compliant with MISRA coding standards. =========================================================================\nUbuntu Security Notice USN-6259-1\nJuly 27, 2023\n\nopen-iscsi vulnerabilities\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS (Available with Ubuntu Pro)\n- Ubuntu 16.04 LTS (Available with Ubuntu Pro)\n\nSummary:\n\nSeveral security issues were fixed in Open-iSCSI. \n\nSoftware Description:\n- open-iscsi: Open Source iSCSI implementation\n\nDetails:\n\nJos Wetzels, Stanislav Dashevskyi, and Amine Amri discovered that\nOpen-iSCSI incorrectly handled certain checksums for IP packets. \nAn attacker could possibly use this issue to expose sensitive information. \n(CVE-2020-13987)\n\nJos Wetzels, Stanislav Dashevskyi, Amine Amri discovered that\nOpen-iSCSI incorrectly handled certain parsing TCP MSS options. \nAn attacker could possibly use this issue to cause a crash or cause\nunexpected behavior. (CVE-2020-13988)\n\nAmine Amri and Stanislav Dashevskyi discovered that Open-iSCSI\nincorrectly handled certain TCP data. An attacker could possibly\nuse this issue to expose sensitive information. (CVE-2020-17437)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\n open-iscsi 2.0.874-7.1ubuntu6.4\n\nUbuntu 18.04 LTS (Available with Ubuntu Pro):\n open-iscsi 2.0.874-5ubuntu2.11+esm1\n\nUbuntu 16.04 LTS (Available with Ubuntu Pro):\n open-iscsi 2.0.873+git0.3b4b4500-14ubuntu3.7+esm1\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n https://ubuntu.com/security/notices/USN-6259-1\n CVE-2020-13987, CVE-2020-13988, CVE-2020-17437\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/open-iscsi/2.0.874-7.1ubuntu6.4\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"db": "CERT/CC",
"id": "VU#815128"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
},
{
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"db": "PACKETSTORM",
"id": "173799"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-17437",
"trust": 2.6
},
{
"db": "CERT/CC",
"id": "VU#815128",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-343-01",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-541018",
"trust": 1.7
},
{
"db": "ICS CERT",
"id": "ICSA-21-068-06",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2021.0767",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.4143",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.1235",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.4363",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021122914",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2020-17437",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "173799",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#815128"
},
{
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"db": "PACKETSTORM",
"id": "173799"
},
{
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"id": "VAR-202012-0245",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2023-12-18T11:07:20.870000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "uIP-Contiki-OS and uIP Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=136802"
},
{
"title": "Siemens Security Advisories: Siemens Security Advisory",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=6f577a90958bcf377827f0a4058f673f"
},
{
"title": "Brocade Security Advisories: Access Denied\nAccess Denied",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=brocade_security_advisories\u0026qid=54887b0d314c8021dc2d190abfce740d"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-17437"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"
},
{
"trust": 2.3,
"url": "https://www.kb.cert.org/vuls/id/815128"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf"
},
{
"trust": 0.8,
"url": "cve-2020-13984 "
},
{
"trust": 0.8,
"url": "cve-2020-13985 "
},
{
"trust": 0.8,
"url": "cve-2020-13986 "
},
{
"trust": 0.8,
"url": "cve-2020-13987 "
},
{
"trust": 0.8,
"url": "cve-2020-13988 "
},
{
"trust": 0.8,
"url": "cve-2020-17437 "
},
{
"trust": 0.8,
"url": "cve-2020-17438 "
},
{
"trust": 0.8,
"url": "cve-2020-17439 "
},
{
"trust": 0.8,
"url": "cve-2020-17440 "
},
{
"trust": 0.8,
"url": "cve-2020-17441 "
},
{
"trust": 0.8,
"url": "cve-2020-17442 "
},
{
"trust": 0.8,
"url": "cve-2020-17443 "
},
{
"trust": 0.8,
"url": "cve-2020-17444 "
},
{
"trust": 0.8,
"url": "cve-2020-17445 "
},
{
"trust": 0.8,
"url": "cve-2020-17467 "
},
{
"trust": 0.8,
"url": "cve-2020-17468 "
},
{
"trust": 0.8,
"url": "cve-2020-17469 "
},
{
"trust": 0.8,
"url": "cve-2020-17470 "
},
{
"trust": 0.8,
"url": "cve-2020-24334 "
},
{
"trust": 0.8,
"url": "cve-2020-24335 "
},
{
"trust": 0.8,
"url": "cve-2020-24336 "
},
{
"trust": 0.8,
"url": "cve-2020-24337 "
},
{
"trust": 0.8,
"url": "cve-2020-24338 "
},
{
"trust": 0.8,
"url": "cve-2020-24339 "
},
{
"trust": 0.8,
"url": "cve-2020-24340 "
},
{
"trust": 0.8,
"url": "cve-2020-24341 "
},
{
"trust": 0.8,
"url": "cve-2020-24383 "
},
{
"trust": 0.8,
"url": "cve-2020-25107 "
},
{
"trust": 0.8,
"url": "cve-2020-25108 "
},
{
"trust": 0.8,
"url": "cve-2020-25109 "
},
{
"trust": 0.8,
"url": "cve-2020-25110 "
},
{
"trust": 0.8,
"url": "cve-2020-25111 "
},
{
"trust": 0.8,
"url": "cve-2020-25112 "
},
{
"trust": 0.8,
"url": "cve-2021-28362 "
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-17437"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.1235"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.4143"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/uip-out-of-bounds-memory-reading-via-uip-process-34721"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021122914"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.0767"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.4363/"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-06"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-068-06"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-13988"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-13987"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-6259-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/open-iscsi/2.0.874-7.1ubuntu6.4"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#815128"
},
{
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"db": "PACKETSTORM",
"id": "173799"
},
{
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#815128"
},
{
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"db": "PACKETSTORM",
"id": "173799"
},
{
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-12-08T00:00:00",
"db": "CERT/CC",
"id": "VU#815128"
},
{
"date": "2020-12-11T00:00:00",
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"date": "2023-07-27T14:33:18",
"db": "PACKETSTORM",
"id": "173799"
},
{
"date": "2020-12-11T23:15:12.683000",
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"date": "2020-12-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-05-11T00:00:00",
"db": "CERT/CC",
"id": "VU#815128"
},
{
"date": "2022-08-08T00:00:00",
"db": "VULMON",
"id": "CVE-2020-17437"
},
{
"date": "2022-08-08T14:57:57.177000",
"db": "NVD",
"id": "CVE-2020-17437"
},
{
"date": "2022-08-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Embedded TCP/IP stacks have memory corruption vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#815128"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-664"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.