An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the length of the TCP payload within the TCP checksum computation function. When the IP payload size is set to be smaller than the size of the IP header, the TCP checksum computation function may read out of bounds (a low-impact write-out-of-bounds is also possible).
Se ha detectado un problema en HCC Nichestack versión 3.0. El código que analiza los paquetes TCP se basa en un valor no comprobado del tamaño de la carga útil IP (extraído del encabezado IP) para calcular la longitud de la carga útil TCP dentro de la función de cálculo de la suma de comprobación TCP. Cuando el tamaño de la carga útil IP está configurado para ser menor que el tamaño del encabezado IP, la función de cálculo de la suma de comprobación TCP puede leer fuera de límites (también es posible una escritura fuera de límites de bajo impacto).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-20
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| hcc-embedded | nichestack | 3.0 | <built-in method update of dict object at 0x7e60ba04fb80> | Application |
| siemens | sentron_3wl_com35_firmware | * | <built-in method update of dict object at 0x7e60bbef5540> | Operating System |
| siemens | sentron_3wa_com190_firmware | * | <built-in method update of dict object at 0x7e60bbef7040> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:hcc-embedded:nichestack:3.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:sentron_3wl_com35_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:sentron_3wl_com35:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:siemens:sentron_3wa_com190_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:siemens:sentron_3wa_com190:-:*:*:*:*:*:*:* |