Published:2013/03/18 Last Updated:2013/03/18
JVN#45545972
VxWorks SSH server (IPSSH) denial-of-service (DoS) vulnerability
Overview
The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability.
Products Affected
- VxWorks 6.5 through 6.9
Description
The SSH server (IPSSH) implementation in VxWorks contains a denial-of-service (DoS) vulnerability due to an issue in processing authentication requests.
Impact
SSH access may become unavailable until the next reboot as a result of processing an authentication request.
Solution
Apply a patch
Apply the appropriate patch according to the information provided by the developer.
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Analyzed on 2013.03.18
Measures | Conditions | Severity |
---|---|---|
Access Required | can be attacked over the Internet using packets |
|
Authentication | anonymous or no authentication (IP addresses do not count) |
|
User Interaction Required | the vulnerability can be exploited without an honest user taking any action |
|
Exploit Complexity | little to no expertise and/or luck required to exploit (cross-side scripting).Expected to be the common response |
|
Credit
Hisashi Kojima and Masahiro Nakada of Fujitsu Laboratories Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
JPCERT Alert | |
JPCERT Reports | |
CERT Advisory |
|
CPNI Advisory |
|
TRnotes |
|
CVE |
CVE-2013-0711 |
JVN iPedia |
JVNDB-2013-000018 |