Integer overflow

2017-02-0717:59:00

PRIOn knowledge base

www.prio-n.com

8.9 High

AI Score

Confidence

High

0.022 Low

EPSS

Percentile

89.5%

JSON

Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.

CPENameOperatorVersion
vxworkseq6.8
vxworkseq6.7
vxworkseq6.4
vxworksle6.9.4.1
vxworkseq6.9
vxworkseq5.5

Name	Operator	Version
vxworks	eq	6.8
vxworks	eq	6.7
vxworks	eq	6.4
vxworks	le	6.9.4.1
vxworks	eq	6.9
vxworks	eq	5.5

References

blogs.windriver.com/wind_river_blog/2015/09/wind-river-vxworks-updateclarification.html

www.securityfocus.com/bid/79205

kb.netapp.com/support/s/article/cve-2015-7599-vxworks-vulnerability-impacting-netapp-e-series-products?language=en_US

security.netapp.com/advisory/ntap-20151029-0001/

www.syscan360.org/slides/2015_EN_AttackingVxWorksFromstoneagetointerstellar_Eric_Yannick.pdf