[Japanese]

JVNDB-2013-000021

VxWorks SSH server (IPSSH) denial-of-service (DoS) vulnerability

Overview

The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability.

The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability due to an issue in the processing authentication requests.

Hisashi Kojima and Masahiro Nakada of Fujitsu Laboratories Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Complete
Affected Products


Wind River Systems
  • VxWorks versions 6.5 through 6.9

Impact

Recieiving a specially crafted packet for a public key authentication request may cause the server to hang and SSH access to be unavailable until the next reboot. In addition, arbitrary code may be executed on the server.
Solution

[Apply a patch]
Apply the appropriate patch according to the information provided by the developer.
Vendor Information

Wind River Systems
CWE (What is CWE?)

  1. No Mapping(CWE-noinfo) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-0714
References

  1. JVN : JVN#20671901
  2. National Vulnerability Database (NVD) : CVE-2013-0714
  3. ICS-CERT ADVISORY : ICSA-13-091-01
Revision History

  • [2013/03/18]
      Web page was published
    [2013/06/25]
      References : Content was added

Date Public2013/03/18
Date First Published2013/03/18
Date Last Updated2013/06/25