Detections
Analytics

Wind River VxWorks < 7.0 Multiple Vulnerabilities

critical Nessus Plugin ID 152701

Language:

Synopsis

The remote VxWorks device is potentially affected by multiple remote code execution and denial-of-service vulnerabilities.

Description

According to its self-reported version, the remote device is Wind River VxWorks and it's affected by multiple vulnerabilities:

 - The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption. (CVE-2020-35198)

 - memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc().
 As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption. (CVE-2020-13603)

Note that Nessus has not tested for this issue but has instead relied only on the OS version.

Solution

Contact the device vendor to obtain the appropriate update

See Also

https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04

Plugin Details

Severity: Critical

ID: 152701

File Name: vxworks_7_0.nasl

Version: 1.3

Type: remote

Family: Misc.

Published: 8/20/2021

Updated: 12/4/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-35198

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:windriver:vxworks

Required KB Items: Host/VxWorks

Exploit Ease: No known exploits are available

Patch Publication Date: 8/17/2021

Vulnerability Publication Date: 8/17/2021

Reference Information

CVE: CVE-2020-13603, CVE-2020-35198

IAVA: 2021-A-0387