CVE-2020-24340

Name of the Vulnerable Software and Affected Versions picoTCP versions through 1.7.0 picoTCP-NG versions through 1.7.0

Description An issue was discovered in the code that processes DNS responses in the pico mdns handle data as answers generic() function in pico mdns.c. This issue leads to an out-of-bounds read, invalid pointer dereference, and Denial-of-Service because the code does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the packet.

Recommendations For picoTCP versions through 1.7.0, consider disabling the pico mdns handle data as answers generic() function until a patch is available. For picoTCP-NG versions through 1.7.0, consider disabling the pico mdns handle data as answers generic() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.