Lucene search

[email protected]CVE-2016-20009

HistoryMar 11, 2021 - 10:15 p.m.

CVE-2016-20009

2021-03-1122:15:00

CWE-787

[email protected]

web.nvd.nist.gov

cve-2016-20009

dns client

buffer overflow

ipdnsc_decode_name

wind river vxworks

nvd

security vulnerability

network security

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

60.7%

JSON

A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CPENameOperatorVersion
windriver:vxworkswindriver vxworksle7.0
siemens:sgt-100_firmwaresiemens sgt-100 firmwareeq*
siemens:sgt-200_firmwaresiemens sgt-200 firmwareeq*
siemens:sgt-300_firmwaresiemens sgt-300 firmwareeq*
siemens:sgt-400_firmwaresiemens sgt-400 firmwareeq*
siemens:sgt-a20_firmwaresiemens sgt-a20 firmwareeq*
siemens:sgt-a35_firmwaresiemens sgt-a35 firmwareeq*
siemens:sgt-a65_firmwaresiemens sgt-a65 firmwareeq*

CPE	Name	Operator	Version
windriver:vxworks	windriver vxworks	le	7.0
siemens:sgt-100_firmware	siemens sgt-100 firmware	eq	*
siemens:sgt-200_firmware	siemens sgt-200 firmware	eq	*
siemens:sgt-300_firmware	siemens sgt-300 firmware	eq	*
siemens:sgt-400_firmware	siemens sgt-400 firmware	eq	*
siemens:sgt-a20_firmware	siemens sgt-a20 firmware	eq	*
siemens:sgt-a35_firmware	siemens sgt-a35 firmware	eq	*
siemens:sgt-a65_firmware	siemens sgt-a65 firmware	eq	*

References

blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/

cert-portal.siemens.com/productcert/pdf/ssa-553445.pdf

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

60.7%

JSON

Related for CVE-2016-20009

prion1 ics1 threatpost1