CVE-2020-13987 Information disclosure in n/a
An out-of-bounds read in the Contiki uIP stack allows attackers to disclose sensitive memory contents via crafted IP packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13987?
CVE-2020-13987 is a high-severity vulnerability in n/a, published on 11 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.
Weakness: CWE-125
Which versions are affected by CVE-2020-13987?
It affects 6 products.
Linux distribution packages (12)
iscsi-initiator-utils Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-iscsiuio Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-iscsiuio-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
python3-iscsi-initiator-utils Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
python3-iscsi-initiator-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-devel Red Hat:enterprise_linux:8::crb | All versions | 0:6.2.1.4-4.git095f59c.el8 |
iscsi-initiator-utils-iscsiuio-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:6.2.1.4-4.git095f59c.el8 |
python3-iscsi-initiator-utils-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:6.2.1.4-4.git095f59c.el8 |
Products include Open-Iscsi Project Open-Iscsi, Siemens Sentron 3va Com100 Firmware, Siemens Sentron 3va Com800 Firmware, Siemens Sentron Pac3200 Firmware, Siemens Sentron Pac4200 Firmware, Uip Project Uip.
How do I fix CVE-2020-13987?
Apply the vendor's patch.
Is CVE-2020-13987 being exploited?
There is no known exploitation of CVE-2020-13987 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2020-13987, GHSA-g438-vfc9-cq65, RHBA-2021:4446, UBUNTU-CVE-2020-13987.