CVE-2020-17467

Published: Dec 11, 2020Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.

Affected (1)

Products: Butok: Fnet

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Butok Fnet	Up to 4.6.4

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (6)

http://fnet.sourceforge.net/manual/fnet_history.html

Source: cve@mitre.org

Release NotesThird Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://www.kb.cert.org/vuls/id/815128

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://fnet.sourceforge.net/manual/fnet_history.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.kb.cert.org/vuls/id/815128

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.