CVE-2020-25767

{"id": "CVE-2020-25767", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-08-18T19:15:07.173", "references": [{"url": "https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.kb.cert.org/vuls/id/608209", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet (e.g., forward compression pointer jumps are allowed), which leads to an Out-of-bounds Read, and a Denial-of-Service as a consequence."}, {"lang": "es", "value": "Se ha detectado un problema en HCC Embedded NicheStack IPv4 versi\u00f3n 4.1. La rutina dnc_copy_in para analizar los nombres de dominio DNS no comprueba si un puntero de compresi\u00f3n de nombre de dominio est\u00e1 apuntando dentro de los l\u00edmites del paquete (por ejemplo, los saltos de puntero de compresi\u00f3n hacia adelante est\u00e1n permitidos), lo que conlleva a una Lectura Fuera de L\u00edmites, y una Denegaci\u00f3n de Servicio como consecuencia."}], "lastModified": "2021-08-26T19:32:38.380", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcc-embedded:nichestack_ipv4:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8853CDA-A6A3-48DC-8D5E-610053740102"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}