CVE-2013-2687

Опубликовано: 12 июл. 2013

Источник: nvd

CVSS2: 7.8

EPSS Низкий

Описание

Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868.

Ссылки

http://aluigi.altervista.org/adv/qnxph_1-adv.txt
Exploit
http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01
Patch
US Government Resource
http://www.qnx.com/download/feature.html?programid=24850
Patch
http://aluigi.altervista.org/adv/qnxph_1-adv.txt
Exploit
http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01
Patch
US Government Resource
http://www.qnx.com/download/feature.html?programid=24850
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:blackberry:qnx_momentics_tool_suite:*:sp1:*:*:*:*:*:*

Версия до 6.5.0 (включая)

cpe:2.3:a:blackberry:qnx_momentics_tool_suite:4.5:*:*:*:*:*:*:*

cpe:2.3:a:blackberry:qnx_momentics_tool_suite:4.6:*:*:*:*:*:*:*

cpe:2.3:a:blackberry:qnx_momentics_tool_suite:4.7:*:*:*:*:*:*:*

cpe:2.3:a:blackberry:qnx_momentics_tool_suite:6.5.0:*:*:*:*:*:*:*

cpe:2.3:a:blackberry:qnx_software_development_platform:-:*:*:*:*:*:*:*

cpe:2.3:o:blackberry:qnx_neutrino_rtos:*:sp1:*:*:*:*:*:*

Версия до 6.5.0 (включая)

cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.4.1:*:*:*:*:*:*:*

cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.0368

Низкий

7.8 High

CVSS2

Дефекты

CWE-119

Связанные уязвимости

GHSA-mmcg-jjwv-h488

github

больше 3 лет назад