VxWorks SSH server (IPSSH) denial-of-service (DoS) vulnerability


The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability.

The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability due to an issue in the processing directly after the SSH connection is established.

Hisashi Kojima and Masahiro Nakada of Fujitsu Laboratories Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: Single Instance
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Complete
Affected Products

Wind River Systems
  • VxWorks versions 6.5 through 6.9


SSH access may become unavailable until the next reboot when receiving a specially crafted packet after a SSH connection is established.

[Apply a patch]
Apply the appropriate patch according to the information provided by the developer.
Vendor Information

Wind River Systems
CWE (What is CWE?)

  1. No Mapping(CWE-noinfo) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-0712

  1. JVN : JVN#01611135
  2. National Vulnerability Database (NVD) : CVE-2013-0712
Revision History

  • [2013/03/18]
      Web page was published
      References : Content was added