cnvd - cnvd-2021-28701

cnvd-2021-28701

Vulnerability from cnvd

Title: Siemens Nucleus产品越界写入漏洞（CNVD-2021-28701）

Description:

Nucleus NET模块包含了一系列符合标准的网络和通信协议、驱动程序和实用程序，以在任何嵌入式设备中提供全功能的网络支持。

Siemens Nucleus产品存在越界写入漏洞。该漏洞是由于DNS域名记录解压缩功能未能正确验证pointeroffset值。解析格式错误的响应可能导致写入超过allocatedstructure的结尾。攻击者可利用漏洞在当前进程的上下文中执行代码或造成拒绝服务情况。

Severity: 高

Patch Name: Siemens Nucleus产品越界写入漏洞（CNVD-2021-28701）的补丁

Patch Description:

Nucleus NET模块包含了一系列符合标准的网络和通信协议、驱动程序和实用程序，以在任何嵌入式设备中提供全功能的网络支持。

Siemens Nucleus产品存在越界写入漏洞。该漏洞是由于DNS域名记录解压缩功能未能正确验证pointeroffset值。解析格式错误的响应可能导致写入超过allocatedstructure的结尾。攻击者可利用漏洞在当前进程的上下文中执行代码或造成拒绝服务情况。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf

Reference: https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf

Impacted products

Name
['Siemens VSTAR', 'Siemens Nucleus Source Code', 'Siemens Nucleus RTOS', 'Siemens Nucleus NET < V5.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-27009"
    }
  },
  "description": "Nucleus NET\u6a21\u5757\u5305\u542b\u4e86\u4e00\u7cfb\u5217\u7b26\u5408\u6807\u51c6\u7684\u7f51\u7edc\u548c\u901a\u4fe1\u534f\u8bae\u3001\u9a71\u52a8\u7a0b\u5e8f\u548c\u5b9e\u7528\u7a0b\u5e8f\uff0c\u4ee5\u5728\u4efb\u4f55\u5d4c\u5165\u5f0f\u8bbe\u5907\u4e2d\u63d0\u4f9b\u5168\u529f\u80fd\u7684\u7f51\u7edc\u652f\u6301\u3002\n\nSiemens Nucleus\u4ea7\u54c1\u5b58\u5728\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eDNS\u57df\u540d\u8bb0\u5f55\u89e3\u538b\u7f29\u529f\u80fd\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1pointeroffset\u503c\u3002\u89e3\u6790\u683c\u5f0f\u9519\u8bef\u7684\u54cd\u5e94\u53ef\u80fd\u5bfc\u81f4\u5199\u5165\u8d85\u8fc7allocatedstructure\u7684\u7ed3\u5c3e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u6216\u9020\u6210\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-28701",
  "openTime": "2021-04-15",
  "patchDescription": "Nucleus NET\u6a21\u5757\u5305\u542b\u4e86\u4e00\u7cfb\u5217\u7b26\u5408\u6807\u51c6\u7684\u7f51\u7edc\u548c\u901a\u4fe1\u534f\u8bae\u3001\u9a71\u52a8\u7a0b\u5e8f\u548c\u5b9e\u7528\u7a0b\u5e8f\uff0c\u4ee5\u5728\u4efb\u4f55\u5d4c\u5165\u5f0f\u8bbe\u5907\u4e2d\u63d0\u4f9b\u5168\u529f\u80fd\u7684\u7f51\u7edc\u652f\u6301\u3002\r\n\r\nSiemens Nucleus\u4ea7\u54c1\u5b58\u5728\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eDNS\u57df\u540d\u8bb0\u5f55\u89e3\u538b\u7f29\u529f\u80fd\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1pointeroffset\u503c\u3002\u89e3\u6790\u683c\u5f0f\u9519\u8bef\u7684\u54cd\u5e94\u53ef\u80fd\u5bfc\u81f4\u5199\u5165\u8d85\u8fc7allocatedstructure\u7684\u7ed3\u5c3e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u6216\u9020\u6210\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens Nucleus\u4ea7\u54c1\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff08CNVD-2021-28701\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens VSTAR",
      "Siemens Nucleus Source Code",
      "Siemens Nucleus RTOS",
      "Siemens Nucleus NET \u003c V5.2"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2021-04-13",
  "title": "Siemens Nucleus\u4ea7\u54c1\u8d8a\u754c\u5199\u5165\u6f0f\u6d1e\uff08CNVD-2021-28701\uff09"
}

CVE-2020-27009 (GCVE-0-2020-27009)

Vulnerability from cvelistv5

Published

2021-04-22 20:42

Modified

2024-08-04 16:03

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CWE

CWE-823 - Use of Out-of-range Pointer Offset

Summary

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf
	https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf

Impacted products

Vendor

Product

Version

▼

Siemens

APOGEE PXC Compact (BACnet)

Version: All versions < V3.5.5

Siemens	APOGEE PXC Compact (P2 Ethernet)	Version: All versions < V2.8.20
Siemens	APOGEE PXC Modular (BACnet)	Version: All versions < V3.5.5
Siemens	APOGEE PXC Modular (P2 Ethernet)	Version: All versions < V2.8.20
Siemens	Nucleus NET	Version: All versions < V5.2
Siemens	Nucleus Source Code	Version: Versions including affected DNS modules
Siemens	TALON TC Compact (BACnet)	Version: All versions < V3.5.5
Siemens	TALON TC Modular (BACnet)	Version: All versions < V3.5.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:03:23.236Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "APOGEE PXC Compact (BACnet)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.5.5"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "APOGEE PXC Compact (P2 Ethernet)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V2.8.20"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "APOGEE PXC Modular (BACnet)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.5.5"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "APOGEE PXC Modular (P2 Ethernet)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V2.8.20"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Nucleus NET",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V5.2"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Nucleus Source Code",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "Versions including affected DNS modules"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "TALON TC Compact (BACnet)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.5.5"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "TALON TC Modular (BACnet)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions \u003c V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-823",
              "description": "CWE-823: Use of Out-of-range Pointer Offset",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-08T09:20:02.298Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2020-27009",
    "datePublished": "2021-04-22T20:42:19",
    "dateReserved": "2020-10-12T00:00:00",
    "dateUpdated": "2024-08-04T16:03:23.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted