CVE-2020-17467
📋 TL;DR
This vulnerability in FNET's LLMNR implementation allows attackers to trigger information disclosure by sending specially crafted DNS requests. The lack of proper null-termination checking in hostname processing can leak memory contents. Systems using FNET library versions through 4.6.4 for network services are affected.
💻 Affected Systems
- FNET TCP/IP stack library
📦 What is this software?
Fnet by Butok
⚠️ Risk & Real-World Impact
Worst Case
Memory contents disclosure including sensitive data, credentials, or system information that could facilitate further attacks
Likely Case
Information leakage that could reveal internal network details or system state
If Mitigated
Limited impact if network segmentation and proper access controls prevent malicious LLMNR requests
🎯 Exploit Status
Requires ability to send crafted LLMNR requests to vulnerable system
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.6.5 and later
Vendor Advisory: http://fnet.sourceforge.net/manual/fnet_history.html
Restart Required: Yes
Instructions:
1. Download FNET version 4.6.5 or later from official source. 2. Replace vulnerable FNET library with patched version. 3. Recompile applications using FNET. 4. Restart affected services or systems.
🔧 Temporary Workarounds
Disable LLMNR service
allDisable Link-Local Multicast Name Resolution service if not required
Configuration dependent on specific implementation
Network segmentation
allRestrict access to LLMNR services using firewall rules
iptables -A INPUT -p udp --dport 5355 -j DROP
netsh advfirewall firewall add rule name="Block LLMNR" dir=in action=block protocol=UDP localport=5355
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send LLMNR requests
- Monitor for unusual LLMNR traffic patterns and investigate anomalies
🔍 How to Verify
Check if Vulnerable:
Check FNET library version in use. If version ≤4.6.4 and LLMNR is enabled, system is vulnerable.Check Version:
Check application documentation or source code for FNET version referenceVerify Fix Applied:
Verify FNET library version is 4.6.5 or later and test LLMNR functionality📡 Detection & Monitoring
Log Indicators:
- Unusual LLMNR request patterns
- Memory access errors in system logs
Network Indicators:
- Unusual UDP traffic on port 5355
- Malformed LLMNR packets
SIEM Query:
udp.dstport == 5355 AND (packet.length > normal OR contains(packet.payload, suspicious_patterns))