[Japanese]

JVNDB-2013-000019

VxWorks SSH server (IPSSH) denial-of-service (DoS) vulnerability

Overview

The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability.

The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability due to an issue in the processing directly after the SSH connection is established.

Hisashi Kojima and Masahiro Nakada of Fujitsu Laboratories Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: Single Instance
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Complete
Affected Products


Wind River Systems
  • VxWorks versions 6.5 through 6.9

Impact

SSH access may become unavailable until the next reboot when receiving a specially crafted packet after a SSH connection is established.
Solution

[Apply a patch]
Apply the appropriate patch according to the information provided by the developer.
Vendor Information

Wind River Systems
CWE (What is CWE?)

  1. No Mapping(CWE-noinfo) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-0712
References

  1. JVN : JVN#01611135
  2. National Vulnerability Database (NVD) : CVE-2013-0712
Revision History

  • [2013/03/18]
      Web page was published
    [2013/06/25]
      References : Content was added

Date Public2013/03/18
Date First Published2013/03/18
Date Last Updated2013/06/25