ICSA-21-315-02

icsaUScisa_csaf_ot

Multiple Data Distribution Service (DDS) Implementations (Update A)

Advisory ansehen veröffentlicht 2021-11-11

Successful exploitation of these vulnerabilities could result in denial-of-service or buffer-overflow conditions, which may lead to remote code execution or information exposure.

01

beschreibt (13)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2021-43547UShigh8.2—
TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to flood target devices with unwanted traffi…
CVE-2021-38487UScritical9.1—
RTI Connext Professional versions 4.1 to 6.1.0, and Connext Micro versions 2.4 and later are vulnerable when an attacker sends a specially crafted packet to flood target devices wi…
CVE-2021-38447UShigh7.5—
OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of…
CVE-2021-38445UScritical9.8—
OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbi…
CVE-2021-38443UScritical9.8—
Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.
CVE-2021-38441UScritical9.8—
Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
CVE-2021-38439UScritical9.8—
All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code.
CVE-2021-38435UScritical9.8—
RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.
CVE-2021-38433UShigh7.8—
RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code.
CVE-2021-38429UScritical9.1—
OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of…
CVE-2021-38427UShigh7.8—
RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary c…
CVE-2021-38425UScritical9.1—
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic,…
CVE-2021-38423UScritical9.8—
All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (91)

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan