An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.
References
Link | Resource |
---|---|
https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf | Patch Third Party Advisory |
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 | Third Party Advisory US Government Resource |
https://www.kb.cert.org/vuls/id/815128 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
AND |
|
Configuration 10 (hide)
AND |
|
Configuration 11 (hide)
AND |
|
History
06 Aug 2022, 03:52
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf - Patch, Third Party Advisory | |
First Time |
Siemens sentron 3va Com100
Siemens sentron Pac2200 Clp Firmware Open-iscsi Project open-iscsi Siemens sentron Pac4200 Siemens sentron Pac2200 Siemens Open-iscsi Project Siemens sentron 3va Dsp800 Firmware Siemens sentron 3va Dsp800 Siemens sentron Pac3200 Siemens sentron Pac3220 Firmware Siemens sentron 3va Com800 Firmware Siemens sentron Pac3200 Firmware Siemens sentron Pac3200t Firmware Siemens sentron Pac4200 Firmware Siemens sentron Pac3200t Siemens sentron 3va Com100 Firmware Siemens sentron 3va Com800 Siemens sentron Pac2200 Firmware Siemens sentron Pac2200 Clp Siemens sentron Pac3220 |
|
CPE | cpe:2.3:o:contiki-os:contiki:3.0:*:*:*:*:*:*:* |
cpe:2.3:h:siemens:sentron_3va_dsp800:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_pac3200_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_3va_com800:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_pac3200t:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_pac2200_clp:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_pac4200_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:contiki-os:contiki:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_pac3220_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_pac2200_clp_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_pac2200_firmware:*:*:*:*:*:*:*:* cpe:2.3:a:uip_project:uip:*:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_3va_com800_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_3va_com100:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_3va_com100_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_pac3200:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_pac3220:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_3va_dsp800_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_pac4200:-:*:*:*:*:*:*:* cpe:2.3:h:siemens:sentron_pac2200:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sentron_pac3200t_firmware:*:*:*:*:*:*:*:* cpe:2.3:a:open-iscsi_project:open-iscsi:*:*:*:*:*:*:*:* |
09 Mar 2021, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2020-12-11 23:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-17437
Mitre link : CVE-2020-17437
CVE.ORG link : CVE-2020-17437
JSON object : View
Products Affected
uip_project
- uip
siemens
- sentron_pac2200_firmware
- sentron_pac2200
- sentron_3va_com800
- sentron_pac3200t
- sentron_pac3200
- sentron_pac4200_firmware
- sentron_pac3220_firmware
- sentron_pac3200t_firmware
- sentron_pac2200_clp_firmware
- sentron_3va_com100_firmware
- sentron_3va_dsp800_firmware
- sentron_pac4200
- sentron_3va_com100
- sentron_3va_com800_firmware
- sentron_pac2200_clp
- sentron_3va_dsp800
- sentron_pac3200_firmware
- sentron_pac3220
contiki-os
- contiki
open-iscsi_project
- open-iscsi
CWE
CWE-787
Out-of-bounds Write