Proof of conceptĪ section of the AMNESIA:33 report includes a proof-of-concept (PoC) for exploiting one of the three RCE vulnerabilities, CVE-2020-25111. Like AMNESIA:33, Ripple20 and URGENT/11 each reportedly affected millions of OT, IoT and IT devices. Ripple20 is a set of 19 vulnerabilities in the TCP/IP library created by Treck, while URGENT/11 is a set of 11 vulnerabilities in VxWorks, a Real-Time Operating System (RTOS). The remaining flaws are primarily Denial of Service or Information Leak vulnerabilities.įollowing in the footsteps of Ripple20 and URGENT/11ĪMNESIA:33 follows in the footsteps of Ripple20 (disclosed in 2020) and URGENT/11 (disclosed in 2019). ), it would redirect the requester to a malicious resource (e.g. If an attacker is able to poison the cache, the next time a request is made to a legitimate resource (e.g. These are attacks that target the DNS cache, which stores requests made to certain resources locally to reduce latency. In addition to the three RCE vulnerabilities outlined above, two of the libraries, uIP and FNET, are affected by DNS Cache Poisoning attacks. Because of the lack of checks, these queries and responses may attempt to write past the allocated memory buffer, resulting in memory corruption. Unlike CVE-2020-24336, which occurs when the uIP library attempts to read past the allocated memory buffer, CVE-2020-24338 occurs when the picoTCP library attempts to write past the allocated memory buffer, which could also result in memory corruption.ĬVE-2020-25111 is an out-of-bounds write vulnerability in the Ethernut (Nut/Net) library due to multiple issues in the way the DNS handles queries and responses and lacks proper checks on null termination, data lengths and the number of queries and responses.
SOURCE AMNESIA FULL
Three out of the four TCP/IP libraries are affected by a RCE vulnerability, which means attackers could potentially execute code and gain full control over the devices.ĬVE-2020-24336 is an out-of-bounds read vulnerability in the way the uIP library parses DNS records, as it does not perform any validation of the length field in the response, which could result in memory corruption.ĬVE-2020-24338 is an out-of-bounds write vulnerability in the way the picoTCP library parses the domain name within DNS packets. The following is a breakdown of the 33 vulnerabilities, including the affected library, vulnerability type, common weakness enumeration, impact and CVSSv3 scores. The 33 vulnerabilities include mostly Denial of Service and Information Leak vulnerabilities along with multiple remote code execution (RCE) flaws.
The four TCP/IP libraries affected by AMNESIA:33 include:įorescout estimates over 150 vendors that have implemented these libraries are affected by AMNESIA:33.Īdditionally, the Cybersecurity and Infrastructure Security Agency (CISA) issued its own advisory for AMNESIA:33.
Dubbed AMNESIA:33, the vulnerabilities exist within four open TCP/IP libraries that are embedded in a number of Operational Technology (OT) and Internet of Things (IoT) devices as well as routers and printers. On December 8, researchers at Forescout published a report for 33 vulnerabilities that reportedly impact millions of devices. Please note that some service detection plugins are not available due to low detection confidence in order to prevent false negative results.
SOURCE AMNESIA UPDATE
Update October 11: The Identifying affected systems section has been updated with information on service detection plugins for the TCP/IP stacks mentioned in this blog post.
0 kommentar(er)
