Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2020-17467 Details

Description

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://fnet.sourceforge.net/manual/fnet_history.html CVERelease NotesThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 CVEThird Party AdvisoryUS Government Resource
https://www.kb.cert.org/vuls/id/815128 CVEThird Party AdvisoryUS Government Resource
http://fnet.sourceforge.net/manual/fnet_history.html [email protected]Release NotesThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 [email protected]Third Party AdvisoryUS Government Resource

see all 6 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-125Out-of-bounds Read[email protected]

Affected Products

ProductVersions
butok fnet
<= 4.6.4

CPE

  • cpe:2.3:a:butok:fnet:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2020-17467
NVD Published Date:
Dec 11, 2020
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2020-17467 Details - Not Deferred