Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020
A set of previously unknown vulnerabilities on the Treck IP stack implementation were disclosed on June 16, 2020. The vulnerabilities are collectively known as Ripple20. Exploitation of these vulnerabilities could result in remote code execution, denial of service (DoS), or information disclosure, depending on the specific vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"]
beschreibt (19)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-11914US | medium4.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read. | ||||
| CVE-2020-11913US | medium5.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. | ||||
| CVE-2020-11912US | medium5.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read. | ||||
| CVE-2020-11911US | medium5.3OT erhöht | — | ||
The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control. | ||||
| CVE-2020-11910US | medium5.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read. | ||||
| CVE-2020-11909US | medium5.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow. | ||||
| CVE-2020-11908US | medium4.3 | — | ||
The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP. | ||||
| CVE-2020-11907US | medium6.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP. | ||||
| CVE-2020-11906US | medium6.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow. | ||||
| CVE-2020-11905US | medium6.5 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read. | ||||
| CVE-2020-11904US | high7.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write. | ||||
| CVE-2020-11903US | medium6.5 | — | ||
The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read. | ||||
| CVE-2020-11902US | high7.3 | — | ||
The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read. | ||||
| CVE-2020-11901US | critical9.0OT erhöht | — | ||
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. | ||||
| CVE-2020-11900US | high8.2 | — | ||
The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free. | ||||
| CVE-2020-11899US | medium5.4OT kritisch | KEV | ||
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. | ||||
| CVE-2020-11898US | critical9.1 | Exploit | ||
The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak. | ||||
| CVE-2020-11897US | critical10.0 | — | ||
The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets. | ||||
| CVE-2020-11896US | critical10.0 | Exploit | ||
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Cisco Bug Search Toolexternal
- CSCvu68945external
- https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.mdexternal
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyCexternal
- Security Vulnerability Policyexternal
- considering software upgradesexternal
- Cisco Security Advisories pageexternal
Behebungen (19)
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
- Kein Fix verfügbar
No remediation is available at this time.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan