5.4Media
KEV
CVE-2020-11899Treck TCP/IP stack Out-of-Bounds Read Vulnerability
Explotación conocida — Treck TCP/IP stack Out-of-Bounds Read Vulnerability
CISA confirmó el 03.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 17.03.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-11899
Descripción
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Debilidad (CWE):
CWE-125
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| dell | wyse 5030 firmware | — | |
| dell | wyse 5050 all-in-one firmware | — | |
| dell | wyse 7030 firmware | — | |
| treck | tcp/ip | < 6.0.1.66 |
Referencias y parches
- https://cwe.mitre.org/data/definitions/125.html Technical Description
- https://www.kb.cert.org/vuls/id/257161/ MitigationThird Party AdvisoryUS Government Resource
- https://www.treck.com ProductVendor Advisory
- https://jsof-tech.com/vulnerability-disclosure-policy/ Broken LinkThird Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html Third Party Advisory
- VU#257161 third-party-advisoryThird Party AdvisoryUS Government Resource
- https://www.jsof-tech.com/ripple20/ Broken LinkExploitThird Party Advisory
- 20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020 vendor-advisoryThird Party Advisory
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt Broken LinkThird Party Advisory
- https://security.netapp.com/advisory/ntap-20200625-0006/ Third Party Advisory
- https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11899 US Government Resource
Coincidencias CPE (NVD) (4)
cpe:2.3:a:treck:tcp\/ip:*:*:*:*:*:*:*:*< 6.0.1.66cpe:2.3:o:dell:wyse_5050_all-in-one_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dell:wyse_7030_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:dell:wyse_5030_firmware:-:*:*:*:*:*:*:*