{
    "vuid": "VU#257161",
    "idnumber": "257161",
    "name": "Treck IP stacks contain multiple vulnerabilities",
    "keywords": null,
    "overview": "### Overview\r\nTreck IP stack implementations for embedded systems are affected by multiple vulnerabilities. This set of vulnerabilities was researched and reported by JSOF, who calls them [Ripple20](https://www.jsof-tech.com/ripple20/).\r\n\r\n### Description\r\nTreck IP network stack software is designed for and used in a variety of embedded systems. The software can be licensed and integrated in various ways, including compiled from source, licensed for modification and reuse and finally as a dynamic or static linked library. Treck IP software contains multiple vulnerabilities, most of which are caused by [memory management bugs](https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152142). For more details on the vulnerabilities introduced by these bugs, see Treck's [ Vulnerability Response Information](https://treck.com/vulnerability-response-information/) and JSOF's  [Ripple20 advisory](https://www.jsof-tech.com/ripple20/).\r\n\r\nHistorically-related KASAGO TCP/IP middleware from Zuken Elmic (formerly Elmic Systems) is also affected by some of these vulnerabilities. \r\n\r\nThese vulnerabilities likely affect industrial control systems and medical devices. Please see ICS-CERT Advisory [ICSA-20-168-01](https://www.us-cert.gov/ics/advisories/icsa-20-168-01) for more information.\r\n\r\n### Impact ###\r\nThe impact of these vulnerabilities will vary due to the combination of build and runtime options used while developing different embedded systems. This diversity of implementations and the lack of supply chain visibility has  exasperated the problem of accurately assessing the impact of these vulnerabilities.  In summary, a remote, unauthenticated attacker may be able to use specially-crafted network packets to cause a denial of service, disclose information, or execute arbitrary code.\r\n\r\n### Solution\r\n#### Apply updates\r\nUpdate to the latest stable version of Treck IP stack software (6.0.1.67 or later). Please contact Treck at <security@treck.com>. Downstream users of embedded systems that incorporate Treck IP stacks should contact their embedded system vendor.\r\n\r\n#### Block anomalous IP traffic\r\nConsider blocking network attacks via deep packet inspection. In some cases, modern switches, routers, and firewalls will drop malformed packets with no additional configuration. It is recommended that such security features are not disabled. Below is a list of possible mitigations that can be applied as appropriate to your network environment.\r\n\r\n* Normalize or reject IP fragmented packets (IP Fragments) if not supported in your environment \r\n* Disable or block IP tunneling, both IPv6-in-IPv4 or IP-in-IP tunneling if not required\r\n* Block IP source routing and any IPv6 deprecated features like routing headers (see also [VU#267289](https://www.kb.cert.org/vuls/id/267289))\r\n* Enforce TCP inspection and reject malformed TCP packets \r\n* Block unused ICMP control messages such MTU Update and Address Mask updates\r\n* Normalize DNS through a secure recursive server or application layer firewall\r\n* Ensure that you are using reliable OSI layer 2 equipment (Ethernet)\r\n* Provide DHCP/DHCPv6 security with feature like DHCP snooping\r\n* Disable or block IPv6 multicast if not used in switching infrastructure\r\n\r\nFurther recommendations are available [here](https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md).\r\n\r\n#### Detect anomalous IP traffic\r\nSuricata IDS has built-in decoder-event rules that can be customized to detect attempts to exploit these vulnerabilities. See the rule below for an example. A larger set of selected [vu-257161.rules](https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/vu-257161.rules) are available from the CERT/CC Github repository.\r\n\r\n`#IP-in-IP tunnel with fragments`  \r\n`alert ip any any -> any any (msg:\"VU#257161:CVE-2020-11896, CVE-2020-11900 Fragments inside IP-in-IP tunnel https://kb.cert.org/vuls/id/257161\"; ip_proto:4; fragbits:M; sid:1367257161; rev:1;)`\r\n\r\n### Acknowledgements\r\nMoshe Kol and Shlomi Oberman of JSOF https://jsof-tech.com researched and reported these vulnerabilities. Treck worked closely with us and other stakeholders to coordinate the disclosure of these vulnerabilities.\r\n\r\nThis document was written by Vijay Sarvepalli.",
    "clean_desc": null,
    "impact": null,
    "resolution": null,
    "workarounds": null,
    "sysaffected": null,
    "thanks": null,
    "author": null,
    "public": [
        "https://www.jsof-tech.com/ripple20/",
        "https://treck.com/vulnerability-response-information/",
        "https://www.us-cert.gov/ics/advisories/icsa-20-168-01",
        "https://jvn.jp/vu/JVNVU94736763/index.html"
    ],
    "cveids": [
        "CVE-2020-11902",
        "CVE-2020-11913",
        "CVE-2020-11898",
        "CVE-2020-11907",
        "CVE-2020-11901",
        "CVE-2020-11903",
        "CVE-2020-11904",
        "CVE-2020-11906",
        "CVE-2020-11910",
        "CVE-2020-11911",
        "CVE-2020-11912",
        "CVE-2020-11914",
        "CVE-2020-11899",
        "CVE-2020-11896",
        "CVE-2020-11897",
        "CVE-2020-11905",
        "CVE-2020-11908",
        "CVE-2020-11900",
        "CVE-2020-11909",
        "CVE-2020-0597",
        "CVE-2020-0595",
        "CVE-2020-8674",
        "CVE-2020-0594"
    ],
    "certadvisory": null,
    "uscerttechnicalalert": null,
    "datecreated": "2020-06-16T17:13:53.220714Z",
    "publicdate": "2020-06-16T00:00:00Z",
    "datefirstpublished": "2020-06-16T17:13:53.238540Z",
    "dateupdated": "2022-09-20T01:54:35.485507Z",
    "revision": 48,
    "vrda_d1_directreport": null,
    "vrda_d1_population": null,
    "vrda_d1_impact": null,
    "cam_widelyknown": null,
    "cam_exploitation": null,
    "cam_internetinfrastructure": null,
    "cam_population": null,
    "cam_impact": null,
    "cam_easeofexploitation": null,
    "cam_attackeraccessrequired": null,
    "cam_scorecurrent": null,
    "cam_scorecurrentwidelyknown": null,
    "cam_scorecurrentwidelyknownexploited": null,
    "ipprotocol": null,
    "cvss_accessvector": null,
    "cvss_accesscomplexity": null,
    "cvss_authentication": null,
    "cvss_confidentialityimpact": null,
    "cvss_integrityimpact": null,
    "cvss_availabilityimpact": null,
    "cvss_exploitablity": null,
    "cvss_remediationlevel": null,
    "cvss_reportconfidence": null,
    "cvss_collateraldamagepotential": null,
    "cvss_targetdistribution": null,
    "cvss_securityrequirementscr": null,
    "cvss_securityrequirementsir": null,
    "cvss_securityrequirementsar": null,
    "cvss_basescore": null,
    "cvss_basevector": null,
    "cvss_temporalscore": null,
    "cvss_environmentalscore": null,
    "cvss_environmentalvector": null,
    "metric": null,
    "vulnote": 7
}
