Multiple vulnerabilities in Treck TCP/IP Stack
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 19 |
| CVE-ID | CVE-2020-11896 CVE-2020-11897 CVE-2020-11898 CVE-2020-11899 CVE-2020-11900 CVE-2020-11901 CVE-2020-11902 CVE-2020-11903 CVE-2020-11904 CVE-2020-11905 CVE-2020-11906 CVE-2020-11907 CVE-2020-11908 CVE-2020-11909 CVE-2020-11910 CVE-2020-11911 CVE-2020-11912 CVE-2020-11913 CVE-2020-11914 |
| CWE-ID | CWE-130 CWE-20 CWE-415 CWE-125 CWE-190 CWE-170 CWE-200 CWE-284 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #3 is available. Vulnerability #4 is being exploited in the wild. |
| Vulnerable software |
TCP/IP stack Other software / Other software solutions |
| Vendor | Treck |
Security Bulletin
This security bulletin contains information about 19 vulnerabilities.
1) Improper Handling of Length Parameter Inconsistency
EUVDB-ID: #VU29089
Risk: High
CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2020-11896
CWE-ID:
CWE-130 - Improper Handling of Length Parameter Inconsistency
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to improper handling of length parameter inconsistency in IPv4/UDP component. A remote attacker can send a specially crafted packet and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Improper Handling of Length Parameter Inconsistency
EUVDB-ID: #VU29090
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11897
CWE-ID:
CWE-130 - Improper Handling of Length Parameter Inconsistency
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to improper handling of length parameter inconsistency in IPv6 component. A remote attacker can send a specially crafted packet, leading to out-of-bounds write issue and execute arbitrary code on the target system.
Mitigation
Install updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper Handling of Length Parameter Inconsistency
EUVDB-ID: #VU29091
Risk: Medium
CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2020-11898
CWE-ID:
CWE-130 - Improper Handling of Length Parameter Inconsistency
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information or perform a denial of service (DoS) attack.
The vulnerability exists due to improper handling of length parameter inconsistency in Pv4/ICMPv4 component. A remote attacker can send a specially crafted packet and trigger out-of-bounds read, leading to information disclosure or denial of service condition.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
4) Input validation error
EUVDB-ID: #VU29092
Risk: Low
CVSSv3.1: 5.2 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:H/RL:O/RC:C]
CVE-ID: CVE-2020-11899
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in IPv6 component. A remote attacker on the local network can pass specially crafted packet, trigger out-of-bounds read and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
5) Double Free
EUVDB-ID: #VU29093
Risk: High
CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11900
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in IPv4 tunneling component. A remote attacker can pass specially crafted packet to the application, trigger double free error and cause a denial of service condition on the target system.
Install updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Input validation error
EUVDB-ID: #VU29094
Risk: High
CVSSv3.1: 7.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11901
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input in DNS resolver component. A remote attacker can send a specially crafted packet and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Input validation error
EUVDB-ID: #VU29095
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11902
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information or perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in IPv6 over IPv4 tunneling component. A remote attacker can send a specially crafted packet to the application and trigger out-of-bounds read, leading to information disclosure or denial of service condition.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Out-of-bounds read
EUVDB-ID: #VU29096
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11903
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in DHCP component. A remote attacker on the local network can send a specially crafted packet, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Integer overflow
EUVDB-ID: #VU29097
Risk: High
CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11904
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in memory allocation component. A remote attacker can send a specially crafted packet, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Out-of-bounds read
EUVDB-ID: #VU29098
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11905
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in DHCPv6 component. A remote attacker on the local network can send a specially crafted packet, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Input validation error
EUVDB-ID: #VU29099
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11906
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input in ethernet link layer component. A remote attacker on the local network can send a specially crafted packet and execute arbitrary code on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Improper Handling of Length Parameter Inconsistency
EUVDB-ID: #VU29100
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11907
CWE-ID:
CWE-130 - Improper Handling of Length Parameter Inconsistency
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to improper handling of length parameter inconsistency in TCP component. A remote attacker on the local network can send a specially crafted packet and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Improper Null Termination
EUVDB-ID: #VU29101
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11908
CWE-ID:
CWE-170 - Improper Null Termination
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper null termination in DHCP component. A remote attacker on the local network can send a specially crafted packet and gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Information disclosure
EUVDB-ID: #VU29102
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11909
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper input validation in IPv4 component. A remote attacker can send a specially crafted packet and gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
15) Input validation error
EUVDB-ID: #VU29103
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11910
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in ICMPv4 component . A remote attacker can send a specially crafted packet, trigger out-of-bounds read and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
16) Improper access control
EUVDB-ID: #VU29104
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11911
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and change one specific configuration value.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
17) Input validation error
EUVDB-ID: #VU29106
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11912
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in TCP component. A remote attacker on the local network can send a specially crafted packet, trigger out-of-bounds read and cause a denial of service condition on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
18) Input validation error
EUVDB-ID: #VU29113
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11913
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in IPv6 component. A remote attacker can send a specially crafted packet, trigger out-of-bounds read and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
19) Input validation error
EUVDB-ID: #VU29114
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-11914
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in ARP component. A remote attacker on the local network can send a specially crafted packet, trigger out-of-bounds read and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsTCP/IP stack: before 6.0.1.66
CPE2.3 External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-168-01
http://treck.com/vulnerability-response-information/
http://kb.cert.org/vuls/id/257161
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
