An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check for a valid length of an extension header, and therefore an out-of-bounds read can occur in _fnet_ip6_ext_header_handler_options in fnet_ip6.c, leading to Denial-of-Service.
The product reads data past the end, or before the beginning, of the intended buffer.
Link | Tags |
---|---|
https://www.kb.cert.org/vuls/id/815128 | third party advisory us government resource |
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 | third party advisory us government resource |
http://fnet.sourceforge.net/manual/fnet_history.html | third party advisory release notes |