CVE-2020-24339

Name of the Vulnerable Software and Affected Versions picoTCP and picoTCP-NG versions through 1.7.0

Description The issue is related to the DNS domain name record decompression functionality in the pico dns decompress name() function, located in pico dns common.c. It does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet. This causes out-of-bounds reads, leading to Denial-of-Service.

Recommendations For picoTCP and picoTCP-NG versions through 1.7.0, consider disabling the pico dns decompress name() function until a patch is available to prevent out-of-bounds reads and Denial-of-Service attacks.